PatchSiren cyber security CVE debrief

CVE-2026-46099 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's IPv6 Segment Routing (seg6) and RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks) lightweight tunnel implementations. The flaw occurs when `seg6_input_core()` and `rpl_input()` call `ip6_route_input()`, which sets a NOREF destination on the socket buffer (skb), then pass it to `dst_cache_set_ip6()` which invokes `dst_hold()` unconditionally. On PREEMPT_RT kernels where ksoftirqd is preemptible, a race condition can occur: a higher-priority task on the same CPU can release the underlying per-CPU route (pcpu_rt) between the lookup and caching operations through a concurrent FIB lookup on a shared nexthop. This results in `dst_hold()` being called on a dead destination, triggering a warning and potential use-after-free. The vulnerability specifically requires PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK and shared nexthop objects that allow concurrent access to the same fib6_nh structure. The fix converts the NOREF destination to a refcounted one by calling `skb_dst_force()` after `ip6_route_input()` before caching.

Vendor: Linux
Product: Unknown
CVSS: HIGH 8.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-08-20
Advisory published: 2026-05-27
Advisory updated: 2026-08-20

Who should care

Organizations running Linux kernels with PREEMPT_RT enabled and using IPv6 Segment Routing (SRv6) or RPL protocols; network infrastructure providers with shared nexthop configurations; real-time embedded systems with IPv6 networking stacks

Technical summary

The vulnerability stems from improper handling of NOREF destinations in IPv6 input path lightweight tunnels. When `ip6_route_input()` sets a NOREF destination on an skb, the subsequent unconditional `dst_hold()` in `dst_cache_set_ip6()` assumes the destination remains valid. However, on PREEMPT_RT systems, the gap between route lookup and caching is preemptible. A concurrent FIB lookup from a higher-priority task can observe a stale per-CPU route (detected via fib6_sernum mismatch), release it via `dst_release()`, and leave the original task with a dangling pointer. The fix ensures proper reference counting by forcing the NOREF destination to become refcounted before caching operations.

Defensive priority

high

Recommended defensive actions

Apply kernel patches from stable branches when available
Prioritize patching systems running PREEMPT_RT kernels with IPv6 Segment Routing or RPL enabled
Monitor for kernel warnings related to dst_hold() on dead destinations
Consider disabling IPv6 SR or RPL if not required as interim mitigation
Review systems using shared nexthop objects with IPv6 routes

Evidence notes

Vulnerability description confirms race condition in seg6_input_core() and rpl_input() functions. Affected code paths involve NOREF destination handling with dst_cache_set_ip6(). Race requires PREEMPT_RT with preemptible ksoftirqd and shared nexthop objects. Fix involves skb_dst_force() call to convert NOREF to refcounted destination.

Sources and references

Verified primary and authoritative sources

CVE-2026-46099 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46099

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46099 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46099

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/52f9db67f8f35f436366cf4980b4f0a2583d0ef0

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/6bd17925bd6866027a6555db17905b9fc073d38d

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9dd5481f960e337b81d7dfe429529495c1c481c0

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/b778b6d095421619c331fd2d7751143cd5387103

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.