CVE-2026-46172: Linux Kernel IPv6 IPsec Memory Leak (Local DoS)

Technical summary

The vulnerability resides in xfrm6_rcv_encap() within the IPv6 IPsec decapsulation path. When a socket buffer (skb) lacks an attached destination cache entry, the function invokes ip6_route_input_lookup() to resolve the route. The ip6_route_input_lookup() function returns a referenced destination entry regardless of whether the lookup result points to an error route. The bug occurs in the error-handling path: if the returned dst->error field is set, xfrm6_rcv_encap() discards the packet without attaching the dst to the skb and critically, without releasing the reference obtained from the lookup. Repeated invocations of this error condition leak unreleased dst entries, gradually depleting kernel memory. The fix requires releasing the dst reference before jumping to the drop path.

Business impact

This vulnerability enables a local denial-of-service attack that degrades system availability. An unprivileged local user can exhaust kernel memory by repeatedly triggering the error condition, eventually forcing system instability, service interruptions, or a complete crash. In multi-tenant or shared-resource environments (containers, cloud instances), this becomes a noisy neighbor problem where one tenant impacts others. Organizations running exposed Linux systems with local user access or those operating virtualized infrastructure face material risk to uptime.

Affected systems

The Linux kernel is affected. The vulnerability exists in IPv6 IPsec handling (xfrm6 subsystem), making it relevant to systems with IPv6 and IPsec enabled, or systems running as network appliances or VPN gateways. The vulnerability is not present in systems where IPv6 is completely disabled, though this is uncommon in modern deployments. Affected systems depend on kernel version; verify your kernel version against the vendor advisory for specific patched releases.

Exploitability

Exploitability is local-only; the CVSS vector specifies AV:L (local attack vector), meaning an attacker must have already obtained local code execution or shell access on the target system. No network exploitation is possible. The attack is trivial to execute once local access is obtained—simply sending malformed IPv6 IPsec packets or triggering the error condition repeatedly via local tools. The barrier to exploitation is entirely the requirement for local system access, not technical complexity.

Remediation

Apply a patched kernel version provided by your Linux distribution or the kernel upstream. The upstream fix is a targeted change to xfrm6_rcv_encap() that adds a dst_release() call in the error path before discarding the packet. Contact your vendor (Red Hat, Canonical, SUSE, etc.) to identify the specific kernel version containing this fix for your distribution and architecture. Until a patch is applied, mitigate by restricting local system access to trusted users only and disabling IPsec on IPv6 if feasible in your environment.

Patch guidance

Wait for your Linux distribution's security advisory to confirm the patched kernel version. Kernel patches are typically released and tested before general availability; the distribution's security team ensures compatibility and integrity. Once available, install the patched kernel and reboot. Test thoroughly in a non-production environment first, as kernel updates carry inherent risk. Verify the update was successfully applied by confirming the kernel version after reboot. If using a cloud provider or container platform, check whether patches are automatically applied to your instances or images.

Detection guidance

Monitor kernel memory usage trends and watch for unusual spikes in memory consumption not correlated with application workload changes. Review kernel logs for dst reference count errors or memory allocation failures related to the IPv6 routing subsystem. Network intrusion detection is unhelpful since the attack is local-only. Focus detection on access logs—identify unexpected shell sessions, sudo usage, or container breakout attempts from unprivileged users. Kernel address sanitizers or memory leak detection tools (if enabled in debug builds) may flag the dst leak during testing.

Why prioritize this

This is a local denial-of-service vulnerability with medium severity (CVSS 5.5). Prioritize it based on your system's exposure to local users. If your servers are single-tenant, locked-down production systems with no shell access for unprivileged users, this poses lower risk. If you run multi-tenant platforms, containers, or systems where local user access is common, this is higher priority because the attack surface is larger and the business impact is direct. It is not as critical as network-exploitable flaws, but the memory exhaustion impact is reliable and difficult to detect in real time.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects a high-availability impact (A:H—denial of service via resource exhaustion) but constrained attack vector (AV:L) and no impact on confidentiality or integrity. The scoring assumes an authenticated attacker with local privileges. The lack of CVSS temporal factors (KEV status, active exploitation) means the score is static, though local exploit development is trivial once code execution is achieved.

Frequently asked questions