CVE-2026-90111 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for managing Linux-based systems, especially those using IPv6 multicast routing, should assess their exposure to this vulnerability and prioritize patching. Those managing critical infrastructure, providing network services, or handling sensitive data may be particularly impacted. Additionally, Linux distribution maintainers, cloud service providers, and teams负责

Why it matters

This use-after-free vulnerability in the Linux kernel's IPv6 multicast routing functionality could lead to system instability, potential privilege escalation, and increased risk of exploit attempts. Linux kernel developers, network administrators, and security teams should assess exposure, prioritize patching, and monitor for potential exploitation attempts.

• Potential system crashes or instability due to use-after-free errors.
• Possible elevation of privileges or unauthorized access.
• Network service disruption or degradation.
• Increased risk of exploit attempts targeting unpatched systems.

Technical summary

The Linux kernel's IPv6 multicast routing (ip6mr) functionality has a use-after-free vulnerability. When an ingress multicast packet misses the MFC (Multicast Forwarding Cache) lookup, it is placed on the unresolved queue. If the underlying route is deleted and freed, and the MFC queue is later resolved with a wrong parent interface, a slab use-after-free occurs. The issue is resolved by removing dst_clone() in ip6mr_cache_report() and dropping skb_dst before queuing unresolved skbs in ip6mr_cache_unresolved().

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patches to address the use-after-free vulnerability in ip6mr.
• Monitor network traffic and system logs for potential exploitation attempts.
• Verify that affected systems are updated with the latest kernel patches.
• Perform a thorough review of network configurations and IPv6 multicast routing settings.
• Check for any exposed systems that require immediate patching or mitigation.
• Track and document changes to network infrastructure and system updates.
• Review system and network logs for signs of potential exploitation.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to the Linux kernel patches. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.