CVE-2026-97472

A flaw was found in the Linux kernel's IPv6 networking subsystem. An attacker on the local network can cause a denial of service to IPv6 temporary address generation by sending router advertisements that temporarily deprecate and then restore a network prefix. Because the kernel improperly maintains address regeneration state when an address prefix is deprecated, it permanently halts the creation of new temporary privacy addresses once the prefix is restored. This failure prevents the periodic rotation of addresses, exposing permanent device identifiers and compromising network privacy.

A Moderate security impact flaw was found in the Linux kernel's IPv6 address configuration (addrconf) subsystem, affecting the kernel and kernel-rt components of Red Hat Enterprise Linux 7, 8, 9, and 10, the kernel components of Red Hat In-Vehicle OS 2, and the RHEL CoreOS images used by OpenShift Container Platform 4 and 5 streams. Red Hat Enterprise Linux 6 is out of support and no fix is planned for it. When a router temporarily deprecates an IPv6 prefix (by sending a Router Advertisement with a zero preferred lifetime or by letting the lifetime expire) and later restores it, the kernel's address worker marks the expiring temporary address as having already generated a replacement without actually creating one. After the prefix is restored, the kernel permanently stops generating new temporary privacy addresses (RFC 8981) for that prefix. An attacker on the local network segment who can send or spoof IPv6 Router Advertisements can trigger this condition to cause a denial of service of temporary address generation: addresses stop rotating and the host's permanent IPv6 address is exposed and used for subsequent connections, degrading network privacy and enabling host tracking, while basic IPv6 connectivity itself is not interrupted. Because exploitation requires an attacker on the adjacent network and the impact is confined to the loss of temporary address rotation, fixes for the affected products have been deferred to a future update. The residual risk is that affected hosts continue to use stable, linkable IPv6 source addresses for the impacted prefix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.