Look up another CVE · open CVE-2026-74398 in the interactive tracker
CVE-2026-74398
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74398 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv6/addrconf.c
- What this is
- NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv6/addr* · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_IPV6 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_IPV6
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv6
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.14 | 5.10.261 | 47b05836705b |
| 3.14 | 5.15.212 | d21be7d05101 |
| 3.14 | 6.1.178 | 875c284c0f98 |
| 3.14 | 6.6.145 | 8ed0ce9ea58d |
| 3.14 | 6.12.97 | 3bdc86d89fd6 |
| 3.14 | 6.18.40 | b61af0268e3d |
| 3.14 | 7.1.5 | e889aa99ad3e |
| 3.14 | 7.2 | 627ac78f2741 |
| 3.10.105 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is reached from inbound ICMPv6 Neighbor Discovery (NS/NA) packets processed by icmp6_rcv()→ndisc_rcv()→addrconf_dad_failure(), the standard IPv6 network receive path on internet-facing servers, cloud VMs, phones, and IoT devices on shared L2 segments.
- AC:LAttack complexity, low
- An attacker controls both sides of the race by flooding forged NS/NA during DAD while concurrently triggering ipv6_del_addr() via RTM_DELADDR/CAP_NET_ADMIN in a user namespace, CNI/orchestration address teardown, or interface-down processing; retries make the narrow window reliably winnable.
- PR:NPrivileges required, none
- Triggering DAD failure requires only unauthenticated ND packet injection on the victim's link; the concurrent ipv6_del_addr() leg needs no victim credentials and can come from automatic address lifecycle events (CNI churn, SLAAC/privacy regeneration, netdev down) rather than attacker admin rights.
- UI:NUser interaction, none
- Exploitation does not require any victim user action such as opening files or mounting filesystems; it targets automatic IPv6 address configuration and DAD processing that occurs during normal network connectivity and boot.
- S:UScope, unchanged
- The corrupted inet6_ifaddr lifecycle and resulting kernel crash occur within kernel memory management; impact does not cross a VM, container, or IOMMU security boundary into a separate authority.
- C:HConfidentiality impact, high
- The race leaves a freed/partially torn-down inet6_ifaddr with corrupted state and a poisoned RCU list entry (LIST_POISON2), constituting use-after-free class memory corruption that can expose adjacent kernel heap contents beyond a pure crash.
- I:HIntegrity impact, high
- Corrupting inet6_ifaddr state after list_del_rcu() and re-queuing dad_work on a dead object enables heap reuse and control of freed object contents, providing a path to arbitrary kernel memory writes and potential code execution beyond denial of service.
- A:HAvailability impact, high
- The demonstrated failure is a general protection fault in ipv6_del_addr() from addrconf_dad_work on the ipv6_addrconf workqueue, causing a kernel oops/panic and complete loss of system availability on affected hosts.