High · published October 4, 2025
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.19.1, < 4.14.324 | 4.14.324 |
| linux/linux_kernel | ≥ 4.15, < 4.19.293 | 4.19.293 |
| linux/linux_kernel | ≥ 4.20, < 5.4.255 | 5.4.255 |
| linux/linux_kernel | ≥ 5.5, < 5.10.192 | 5.10.192 |
| linux/linux_kernel | ≥ 5.11, < 5.15.128 | 5.15.128 |
| linux/linux_kernel | ≥ 5.16, < 6.1.47 | 6.1.47 |
| linux/linux_kernel | ≥ 6.2, < 6.4.12 | 6.4.12 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |