CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv()

Synopsis

A use-after-free (UAF) vulnerability exists in the Linux kernel's ICMPv6 receive path, specifically in the icmpv6_rcv() function. The flaw arises because source and destination IPv6 address pointers are cached before pskb_pull() is called; if that operation reallocates the socket buffer's head, the cached pointers reference freed memory. An unauthenticated attacker reachable over the network can exploit this to read sensitive kernel memory, corrupt kernel data structures, or crash the host, with no user interaction required. Patched-image rebuilds at the fix commits are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ICMPv6 code path is reachable over the network; an attacker must be able to send crafted ICMPv6 packets to the target host.

• AuthenticationNot required

  No account or credential of any kind is required; the attacker sends unauthenticated network packets directly to the affected service.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user or administrator on the target system needs to take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond network access.

Blast Radius

• A successful attacker can read arbitrary kernel memory, exposing secrets such as cryptographic keys, credentials, or other processes' data mapped into kernel space.
• The attacker can corrupt kernel data structures, enabling privilege escalation or persistent code execution inside the kernel.
• The vulnerability can be triggered to crash the affected host entirely, taking down all containerized workloads running on that node.
• Any container sharing the host kernel, regardless of namespace isolation, is exposed if the host kernel is vulnerable.