CVE-2026-64132

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The bug is in `ipv6_hop_ioam()`, reached from `ipv6_rcv()` → `ip6_rcv_core()` → `ipv6_parse_hopopts()` → `ip6_parse_tlv()` when processing IPv6 hop-by-hop IOAM options on ingress. A remote attacker can deliver the trigger with a crafted IPv6 packet to any internet-facing or LAN-reachable host/router that has IOAM ingress enabled.

AC:LAttack complexity, low

Exploitation requires `skb_ensure_writable()` to reallocate via `pskb_expand_head()`, which occurs when the skb is cloned (e.g., bridge flooding/multicast forwarding sets `skb->cloned` on the original before local delivery to the IP stack). An attacker can reliably create this condition with concurrent traffic/topology choices rather than depending on uncontrollable timing or memory layout.

PR:NPrivileges required, none

The attacker needs no privileges on the victim system—only the ability to send IPv6 packets. IOAM namespace/sysctl configuration is a victim-side deployment prerequisite (typical on carrier/ISP telemetry nodes), not a privilege the attacker must hold.

UI:NUser interaction, none

Exploitation is fully attacker-driven by sending a malicious IPv6 packet and requires no action from a victim user.

S:UScope, unchanged

The vulnerability is a kernel heap use-after-free in IPv6 packet processing; successful exploitation would compromise the kernel/host itself, not cross a separate security authority such as a VM guest-to-host or sandbox boundary.

C:HConfidentiality impact, high

After `pskb_expand_head()` frees the old skb buffer, the stale `hdr` pointer is dereferenced for `hdr->opt_len`, constituting a use-after-free read of freed kernel memory; that attacker-influenced length is then used in `ioam6_event_put_trace()`/`nla_put()`, enabling out-of-bounds kernel memory reads and information disclosure.

I:HIntegrity impact, high

Use-after-free of heap metadata enables memory corruption primitives; the corrupted `opt_len` fed into netlink attribute construction can cause out-of-bounds reads whose contents are attacker-influenced, and UAF bugs in skb handling are classically leveragable toward arbitrary kernel write/code execution.

A:HAvailability impact, high

Reading freed memory and passing a corrupted length into `nla_put()` can cause kernel oops/panic (especially with KASAN/overflow checks), and UAF conditions inherently risk system crashes even when full exploitation is not attempted.