CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink().

Synopsis

A use-after-free memory corruption bug affects the Linux kernel's ip6erspan tunnel driver (ip6_gre). The flaw is exploitable locally by a low-privilege user who can create a user or network namespace, requiring no network access and no elevated credentials. Successful exploitation gives an attacker full read, write, and crash capability over kernel memory, enabling privilege escalation or denial of service. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no inbound network access to the target service is required.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attack path is reachable via an unprivileged user namespace (for example, unshare --user --map-root-user --net).

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the bug entirely through their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• An attacker reads arbitrary kernel memory, including credentials, session tokens, and data belonging to other processes.
• An attacker writes to arbitrary kernel memory, enabling privilege escalation to root or modification of security-sensitive kernel structures.
• The slab-use-after-free and subsequent kernel BUG in unregister_netdevice_many_notify() can crash the host, taking down all workloads on the node.
• The stale netns hash entry persists until netns teardown, meaning the window for exploitation extends beyond the initial tunnel reconfiguration.