Critical 9.8Published Aug 10, 2026

CVE-2026-68127ila: reload IPv6 header after pskb_may_pull in checksum adjust

Updated under an hour ago (Oct 28, 2026, 6:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 33f11d16142b06588eedfc1dd8cf93790979a712 before e451a904606c571f731ef7a06b3398619dce5300; 33f11d16142b06588eedfc1dd8cf93790979a712 builds before 1eadcb43893b897ade85ac5bf5c618054bc3c655; from 33f11d16142b06588eedfc1dd8cf93790979a712 before ba353caafb06ccee57b78d3254e3cebf1dea4a93; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 896a9512d0d83c2a4b357e5585b7b62a8e3f95c1; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 7097a0280b178237265681be66d1bef11d15894b; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 472aba2603ca74c4f7722cb0c0296942b0776b8d; from 33f11d16142b06588eedfc1dd8cf93790979a712 before c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 92d3817649df2b0b6a008a686c8275c88d7ef594	CNA record

References

References

https://git.kernel.org/stable/c/e451a904606c571f731ef7a06b3398619dce5300
https://git.kernel.org/stable/c/1eadcb43893b897ade85ac5bf5c618054bc3c655
https://git.kernel.org/stable/c/ba353caafb06ccee57b78d3254e3cebf1dea4a93
https://git.kernel.org/stable/c/896a9512d0d83c2a4b357e5585b7b62a8e3f95c1
https://git.kernel.org/stable/c/7097a0280b178237265681be66d1bef11d15894b
https://git.kernel.org/stable/c/472aba2603ca74c4f7722cb0c0296942b0776b8d
https://git.kernel.org/stable/c/c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc
https://git.kernel.org/stable/c/92d3817649df2b0b6a008a686c8275c88d7ef594

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.