CVE-2026-46260: Linux Kernel IPv6 Routing Out-of-Bounds Read Vulnerability

Technical summary

CVE-2026-46260 is a slab-out-of-bounds read vulnerability in net/ipv6/ip6_fib.c within the Linux kernel's IPv6 Forwarding Information Base (FIB) management code. The bug occurs when `fib6_add_rt2node()` processes route entries created via netlink with the RTA_NH_ID attribute. When such a route is created, the associated `fib6_info` structure is allocated without a trailing `fib6_nh` member. A recent kernel change introduced a check of `iter->fib6_nh->fib_nh_gw_family` without first validating that the `fib6_nh` member exists. If an iterator's `nh` field is non-NULL, the code should bypass this check entirely, but the current logic attempts to dereference `fib6_nh` regardless. This results in reading one byte beyond the allocated object, as reported by KASAN (Kernel Address Sanitizer) at offset 0xde in the slab allocation. The CVSS 3.1 score of 7.8 reflects high severity due to information disclosure and denial-of-service potential via a local, low-privilege attack vector with no user interaction required.

Business impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive kernel memory, potentially revealing cryptographic material, user credentials, or system configuration details. A local attacker could also reliably crash systems by triggering the out-of-bounds read, resulting in denial of service. For organizations running Linux on servers or containers, this translates to risk of privilege escalation chains (if disclosed data is leveraged), unplanned downtime, and potential compliance violations if sensitive data exposure occurs. The attack requires local system access, so the threat surface is primarily internal; however, containerized environments and multi-tenant cloud deployments face elevated risk if workload isolation is incomplete.

Affected systems

The Linux kernel is affected. The vulnerability appears in the IPv6 routing subsystem and is triggered during IPv6 route insertion operations via netlink. Any system running an affected Linux kernel version that processes IPv6 route configuration—whether via user-space routing daemons, container orchestration platforms, or manual `ip route` commands—is potentially vulnerable. The issue manifests during normal operation of IPv6 address management and does not require exotic or undocumented kernel configurations. Specific kernel versions containing this flaw should be verified against the official Linux kernel repository and vendor advisories (check your distribution's security announcements for precise affected versions and patch availability).

Exploitability

The vulnerability is exploitable by any unprivileged local user on the system. Exploitation does not require special capabilities, race conditions, or kernel features to be enabled. A user with basic shell access can trigger the vulnerable code path by attempting to add an IPv6 route with RTA_NH_ID via netlink (e.g., using standard `ip` command-line tools). The KASAN trace confirms the crash is triggered through normal netlink route insertion syscalls. The attack is deterministic and does not depend on ASLR or other probabilistic factors, making it reliable. No privilege escalation is required to reach the vulnerable code; however, the information disclosed or the denial-of-service outcome may facilitate further attacks by a local attacker seeking to escalate privileges or disrupt services.

Remediation

Update the Linux kernel to a version that includes the fix for this out-of-bounds read. The fix involves adding a check for `iter->nh != NULL` before dereferencing `iter->fib6_nh->fib_nh_gw_family` in the `fib6_add_rt2node()` function. This ensures that if a route entry's next-hop is managed externally (via RTA_NH_ID), the code path that inspects the inline `fib6_nh` member is skipped. Check your Linux distribution's security advisories and kernel release notes for the specific patched version number applicable to your deployment. Patched kernel versions should be available from your vendor (Red Hat, Canonical, SUSE, etc.) or the upstream Linux kernel project. Apply patches promptly, as local users are typically present in production environments.

Patch guidance

Coordinate with your infrastructure and release management teams to schedule kernel updates. Test the patched kernel in a staging environment that mirrors your production IPv6 configuration before rolling out to production systems. For systems running container orchestration (Kubernetes, Docker, etc.), ensure node kernel updates are applied during maintenance windows, as this may require node drains or brief restarts. For embedded systems or appliances using custom Linux kernels, consult your vendor for patched firmware or kernel builds. Verify the patch by confirming the presence of the `iter->nh` null check in the patched `net/ipv6/ip6_fib.c` source code (around line 1142). If your kernel version is not yet patched, consider temporary mitigation by restricting unprivileged netlink access via AppArmor, SELinux, or seccomp policies, though this is not a substitute for patching.

Detection guidance

Monitor kernel logs for KASAN warnings containing 'slab-out-of-bounds' and references to `fib6_add_rt2node` or `ip6_fib.c` if KASAN is enabled in your kernel build. If KASAN is not available, watch for unexpected kernel oops or crashes following IPv6 route configuration changes. In production, enable audit logging for netlink operations (auditctl rules targeting the netlink syscall) to correlate suspicious route changes with crash events. Correlate sudden restarts or kernel panics with local user activity on systems handling IPv6 routes. Use vulnerability scanning tools to identify systems running unpatched kernel versions by matching kernel version numbers against known-vulnerable ranges from your distribution vendor. Implement intrusion detection rules to flag repeated netlink route operations from unprivileged processes, which may indicate exploitation attempts.

Why prioritize this

This vulnerability merits high-priority patching because it is locally exploitable without privilege escalation, affects a core kernel subsystem (IPv6 routing) present in most modern Linux systems, and carries both information disclosure and denial-of-service risks. The out-of-bounds read exposes kernel memory, and the deterministic crash vector enables reliable denial of service. While the attack surface is limited to local users, the prevalence of multi-tenant environments, containerized workloads, and compromised user accounts makes local access more probable than in isolated systems. Organizations with strict uptime requirements or those handling sensitive data should treat this as high-priority. Systems in restricted, air-gapped environments with minimal local user activity may defer patching slightly, but should not leave the issue unaddressed for extended periods.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of a local attack vector (AV:L) with low attack complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U), meaning the vulnerability does not affect resources outside the vulnerable component's scope. However, the impact is high across all three dimensions: confidentiality (C:H) due to information disclosure via out-of-bounds memory read, integrity (I:H) because a local attacker could corrupt kernel data structures to modify routing behavior or escalate privileges, and availability (A:H) due to the reliable denial-of-service crash. The score appropriately elevates this beyond a medium-severity issue because any local user can trigger the vulnerability, and the consequences span multiple security properties.

Frequently asked questions