CVE-2026-89563

A flaw was found in the ip6_tunnel module of the Linux kernel. Incorrect handling of socket buffers (skb) during headroom reallocation in the ip6_tnl_xmit() function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller still holds a pointer to it, potentially allowing the same memory to be freed twice. This memory corruption issue could lead to a denial of service or potentially arbitrary code execution.

Red Hat has evaluated this vulnerability as an Important severity flaw because an authenticated local user capable of transmitting packets over configured IPv6 tunnels can trigger memory corruption, potentially leading to a kernel crash or privilege escalation. IPv6 tunneling mechanisms are not actively configured in standard enterprise deployments by default, requiring specific network setups or unprivileged user namespace capabilities to reach the vulnerable transmit path. The flaw's capacity to induce a double-free condition directly compromises kernel memory integrity and host stability, elevating the risk beyond a standard denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ip6_tunnel kernel module from being loaded:

1. Create a configuration file to blacklist the module:

echo "install ip6_tunnel /bin/true" > /etc/modprobe.d/disable-ip6_tunnel.conf

2. If the module is already loaded, unload it:

modprobe -r ip6_tunnel

Warning: Unloading the module will fail if it is actively in use by network interfaces, in which case a system reboot is required to ensure the module is not loaded. Disabling this module will completely prevent the operation of IPv6 tunnels (including ip6tnl and IPv6 GRE), disrupting any network infrastructure dependent on IPv6 encapsulation.