CVE-2026-46099 Linux CVE debrief

Who should care

Linux administrators, security teams, and network operators should assess exposure and prioritize patching for affected kernel versions. They should verify Linux kernel versions to determine exposure, assess network exposure for Linux systems using affected kernel versions, and prioritize patching to prevent potential use-after-free errors.

Why it matters

CVE-2026-46099 is a use-after-free vulnerability in the Linux kernel's IPv6 seg6 and rpl lwtunnels. Linux administrators and security teams should assess exposure and prioritize patching for affected kernel versions to prevent potential use-after-free errors.

• Verify Linux kernel versions to determine exposure.
• Assess network exposure for Linux systems using affected kernel versions.
• Prioritize patching to prevent potential use-after-free errors.
• Monitor Linux systems for unusual network activity.

Technical summary

The Linux kernel's IPv6 seg6 and rpl lwtunnels are vulnerable to a use-after-free error. When ksoftirqd is preemptible, a concurrent task can release a pcpu_rt while it is being cached, leading to a use-after-free error when trying to cache the dst. The vulnerability is resolved through several patches in the Linux kernel. Affected Linux kernel versions include 4.12 to 5.15.209, 5.16 to 6.1.175, 6.2 to 6.6.140, 6.7 to 6.12.86, 6.13 to 6.18.27, 6.19 to 7.0.4, and 7.1 rc1. Linux administrators and security teams should assess exposure and prioritize patching for affected kernel versions.

Defensive priority

Linux administrators and security teams should assess exposure and prioritize patching for affected kernel versions.

Recommended defensive actions

• Assess exposure for Linux systems using affected kernel versions.
• Prioritize patching for Linux kernel versions 4.12 to 5.15.209, 5.16 to 6.1.175, 6.2 to 6.6.140, 6.7 to 6.12.86, 6.13 to 6.18.27, 6.19 to 7.0.4, and 7.1 rc1.
• Monitor Linux systems for unusual network activity.
• Verify Linux kernel versions and apply patches from Linux vendors.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was resolved in the Linux kernel through several patches. Official CVE Program and NVD records provide details. Linux kernel versions 4.12 to 5.15.209, 5.16 to 6.1.175, 6.2 to 6.6.140, 6.7 to 6.12.86, 6.13 to 6.18.27, 6.19 to 7.0.4, and 7.1 rc1 are affected. The vulnerability occurs when a concurrent task releases a pcpu_rt while ksoftirqd is preemptible, leading to a use-after-free error when trying to cache the dst.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.