CVE-2026-23010
kernel: Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 25, 2026
Updated · July 12, 2026
Description
A flaw was found in the Linux kernel. An issue exists in the inet6_addr_del() function, where a use-after-free vulnerability can be triggered due to an incorrect order of operations when deleting IPv6 temporary addresses. A local attacker with low privileges could exploit this flaw to potentially cause a denial of service, disclose sensitive information, or achieve privilege escalation.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CWE-825 · Expired Pointer Dereference