CVE-2026-53006

The problem consists of buffering saddr and daddr pointers (source and destination IPv6 addresses) before calling the pskb_pull() function. The pskb_pull() operation can change the skb->head pointer, causing previously saved pointers to become invalid and point to freed or other memory area. The fix eliminates temporary variables and references addresses through ipv6_hdr(skb) exclusively in the code slow path, when net_dbg_ratelimited() is called, which prevents potential UAF.

A remote attacker, without authentication, can cause reading or writing in a freed kernel memory area, which poses a threat to data confidentiality and integrity, and potentially destabilizes the system (availability).

Patches available from the manufacturer should be applied in accordance with the references — changes available under the indicated commits in the stable.kernel.org repository

Linux kernel versions indicated in manufacturer references (commits available on stable.kernel.org)