CVE-2026-80792 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, system administrators, and security teams responsible for Linux-based systems, especially those with BPF-enabled networking configurations, should assess exposure and prioritize verification of affected systems.

Why it matters

CVE-2026-80792 is a use-after-free vulnerability in the Linux kernel's IPv6 implementation that can lead to sensitive kernel data leakage, neighbour table pollution, traffic misdirection, or system crashes. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with BPF-enabled networking configurations.

• Sensitive kernel data leakage.
• Neighbour table pollution with arbitrary values.
• Traffic misdirection due to stale neighbour entries.
• Potential system crashes due to use-after-free reads.

Technical summary

The ip6_finish_output2() function in the Linux kernel's IPv6 implementation caches a pointer to the IPv6 destination address before invoking lwtunnel_xmit(). If lwtunnel_xmit() reallocates the skb head and frees the memory that the pointer points to, the function will continue to use the stale pointer, resulting in a use-after-free read. This can lead to sensitive kernel data leakage, neighbour table pollution, traffic misdirection, or system crashes.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with BPF-enabled networking configurations.

Recommended defensive actions

• Review Linux kernel configurations and BPF-enabled networking setups to assess exposure.
• Verify system logs for suspicious IPv6 traffic patterns.
• Update to the latest Linux kernel version or apply patches as available.
• Monitor for potential crashes or misdirected traffic.
• Perform a thorough asset inventory to identify potentially affected systems.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track and document exceptions, and retest remediated assets.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the corpus does not establish specific affected versions or exploitation instances. Official sources indicate a fix has been resolved in the Linux kernel.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.