CVE-2026-68127

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ila: reload IPv6 header after pskb_may_pull in checksum adjust<br /> <br /> ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling<br /> pskb_may_pull(). On a non-linear skb whose transport header sits in a page<br /> fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head()<br /> and free the old skb head, leaving ip6h dangling; the following<br /> get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator()<br /> uses ip6h (and the iaddr derived from it) again after the csum-adjust<br /> call and additionally writes the new locator through that pointer.<br /> <br /> Impact: a remote IPv6 packet routed through a configured ILA<br /> csum-adjust-transport route or receive-side mapping triggers a<br /> slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or<br /> mapping requires CAP_NET_ADMIN to configure, but trigger packets are<br /> unauthenticated once it exists.<br /> <br /> Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport()<br /> before the csum-diff read. In ila_update_ipv6_locator() only the<br /> ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in<br /> that case alone before the destination-address write; the neutral-map<br /> modes never pull and keep their cached pointers.