CVE-2026-80792

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6_finish_output2() function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).

This vulnerability is rated as Important severity because successful exploitation allows a local user to leverage a use-after-free condition during lightweight tunnel transmission, potentially compromising system stability, leaking sensitive kernel memory, or tampering with network routing tables. Systems running Red Hat Enterprise Linux 9 and 10 or OpenShift Container Platform are affected when IPv6 network traffic undergoes lightweight tunnel encapsulation or BPF transit actions. Earlier releases including Red Hat Enterprise Linux 7 and 8 do not incorporate the vulnerable networking logic and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.