CVE-2026-53259: Linux Kernel IPv6 Anycast Use-After-Free Vulnerability

Technical summary

The vulnerability (CWE-416: Use After Free) occurs in IPv6 anycast address management within the Linux kernel. In __ipv6_dev_ac_inc(), an anycast address (aca) structure is allocated and added to a per-device list (idev->ac_list) under the device lock. However, ipv6_add_acaddr_hash() runs after the lock is released, creating a race window. Concurrently, ipv6_ac_destroy_dev() (invoked during device teardown under RTNL) can remove the address from the per-device list and release its reference before the hash insertion completes. Since hash removal is a no-op when the address was never inserted, the structure is freed while still linked in inet6_acaddr_lst[]. Subsequent RCU readers of the hash table dereference freed memory. The patch moves ipv6_add_acaddr_hash() inside the idev->lock critical section and switches acaddr_hash_lock to spin_lock_bh() to maintain proper lock ordering and prevent interrupt inversion.

Business impact

This vulnerability can cause unplanned kernel crashes on systems hosting IPv6 applications, particularly those performing frequent IPv6 anycast join/leave operations during interface reconfigurations. Affected systems may experience availability disruptions, unexpected reboots, or information disclosure if attackers craft specific workloads to trigger the race. Organizations running custom IPv6 applications or load-balanced services that manage IPv6 anycast addresses are at higher risk of impact.

Affected systems

All Linux kernel versions are affected. The vulnerability resides in core IPv6 network stack code present across all maintained kernel branches. Any Linux distribution using the affected code is vulnerable if the system supports IPv6 and allows local users to trigger IPv6 anycast operations.

Exploitability

The vulnerability requires local code execution (privilege level: low) on the affected system. An attacker with local user access can trigger the race condition by rapidly joining and leaving IPv6 anycast groups while inducing interface reconfigurations. The race window is narrow but reliably exploitable through concurrently running operations. No network access or special privileges are required beyond local execution capability. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector, low privileges needed, and direct impact on confidentiality, integrity, and availability.

Remediation

Apply the kernel patch that relocates ipv6_add_acaddr_hash() into the idev->lock protected section and converts all acaddr_hash_lock operations to use spin_lock_bh(). This ensures atomic insertion into both the per-device list and global hash table with respect to concurrent teardown. Verify against vendor advisories for the specific kernel version deployed in your environment to identify the exact patch or kernel version that includes this fix.

Patch guidance

Identify your current kernel version using 'uname -r' and check the Linux kernel security advisory database for the specific fix commit or patched release version applicable to your branch (stable, longterm, etc.). The resolution involves moving hash insertion under lock protection; patch application should be validated through testing IPv6 anycast operations under load before production deployment. Prioritize kernel updates for systems actively using IPv6 features.

Detection guidance

Monitor system logs for kernel panics (Oops, BUG_ON, or KASAN messages) mentioning 'inet6_acaddr_lst', 'ipv6_chk_acast_addr', or 'use-after-free' in stack traces. Enable kernel Address Sanitizer (KASAN) on non-production systems to detect memory safety issues early. Track IPv6 interface state changes and anycast group memberships in environments under active development or testing. Network telemetry showing unexpected interface resets or IPv6 traffic disruptions may correlate with exploitation attempts.

Why prioritize this

This is a HIGH-severity local privilege escalation and denial of service vector affecting all Linux systems. While it requires local access, the simplicity of triggering the race (IPv6 operations + interface reconfigurations) and the potential for kernel crash or information disclosure make it a priority for patching in production environments, especially those running custom IPv6 applications or multi-tenant systems.

Risk score, explained

CVSS 3.1 score of 7.8 reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction needed (UI:N), high impact across confidentiality (C:H), integrity (I:H), and availability (A:H). The score appropriately captures the ease of triggering kernel memory corruption once local access is obtained, offsetting the local-only attack surface.

Frequently asked questions