CVE-2026-64132

A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM) component. This vulnerability, a use-after-free, occurs when the kernel fails to correctly update a pointer after reallocating a network packet's buffer. This oversight could allow an attacker to trigger a system crash, leading to a denial of service, or potentially lead to more severe impacts like information disclosure or arbitrary code execution.

Red Hat has rated this vulnerability as having an Important severity because exploitation of the memory corruption flaw could enable an authenticated local attacker to crash the operating system or potentially execute arbitrary code with elevated kernel privileges. The issue resides within kernel handling of IPv6 IOAM (In-situ Operations, Administration, and Maintenance) options and requires specific buffer expansion during network packet processing to trigger. Earlier releases including Red Hat Enterprise Linux 7, 8, and 9 do not incorporate the vulnerable code and are therefore not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure IPv6 In-situ Operations, Administration, and Maintenance (IOAM) processing is disabled across all network interfaces.

By default, IOAM processing is disabled (value set to 0). If it has been enabled, disable it dynamically using sysctl:

sysctl -w net.ipv6.conf.all.ioam6_enabled=0

sysctl -w net.ipv6.conf.default.ioam6_enabled=0

To persist these settings across system reboots, create a file in /etc/sysctl.d/:

cat << 'EOF' > /etc/sysctl.d/99-disable-ioam.conf

net.ipv6.conf.all.ioam6_enabled = 0 net.ipv6.conf.default.ioam6_enabled = 0 EOF

sysctl --system

Caveats: Disabling IOAM prevents the kernel from processing IPv6 IOAM trace options, which will impact network telemetry or diagnostic utilities relying on in-situ telemetry data.

Warning: Runtime sysctl modifications take effect immediately without requiring a system restart; however, verify that interface-specific sysctl entries (net.ipv6.conf.<interface>.ioam6_enabled) are also set to 0 if previously configured.