CVE Intelligence
Analysis AI-assisted

CVE-2026-53006: Linux kernel IPv6 ICMPv6 use-after-free in icmpv6_rcv

CVE-2026-53006 is a use-after-free flaw in the IPv6 ICMPv6 receive path of the Linux kernel, classified as CWE-416. The CNA rates it 9.8 (CVSS 3.1, Critical), and the record lists fixes across several stable kernel branches and Red Hat Enterprise Linux releases. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-53006 is a use-after-free issue (CWE-416) in the IPv6 ICMPv6 receive function icmpv6_rcv() of the Linux kernel. According to the kernel description, the code cached source and destination addresses before calling pskb_pull(), which can change the buffer head, so the fix removes those temporary variables and reads the header fields directly where they are needed. The record was published on 2026-06-24 and its source status is Modified. See NVD entry and the upstream stable commit.

Impact

The CNA assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability, no privileges, no user interaction and high impact to confidentiality, integrity and availability. A second score in the record, from a provider not identified in the data, is lower. The kernel text itself only describes the memory-safety defect, so the concrete consequences beyond that defect are not spelled out in the record.

Affected products and versions

The record lists the following Linux kernel ranges as affected:

  • ≥ 4.4 and < 5.10.258
  • ≥ 5.11 and < 5.15.209
  • ≥ 5.16 and < 6.1.175
  • ≥ 6.2 and < 6.6.141
  • ≥ 6.7 and < 6.12.91
  • ≥ 6.13 and < 6.18.33
  • ≥ 6.19 and < 7.0.10

The record also lists Red Hat Enterprise Linux 8.0, 9.0 and 10.0 as affected. Several Red Hat errata are referenced, including the Red Hat CVE page and the Red Hat bug tracker entry. The contents of those errata were not reviewed here, so the exact package builds per release are unknown.

Exploitation status

The record does not list this CVE in CISA KEV, and it contains no EPSS or SSVC data. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify systems running a kernel within the affected ranges, including distribution kernels that backport fixes.
  • Apply the stable kernel update for your branch or the vendor update for your distribution, then reboot into the fixed kernel.
  • For Red Hat Enterprise Linux, follow the errata referenced by Red Hat for your release.
  • Prioritize hosts that receive IPv6 traffic from untrusted networks, since the CNA vector indicates network reachability.
  • The record does not describe workarounds; if patching is delayed, rely on your own risk assessment.

Detection guidance

  • Maintain an inventory of kernel versions and compare them against the ranges above and your vendor's advisories.
  • Review kernel logs for unexpected crashes or memory-related warnings in the networking stack on systems that process IPv6 traffic.
  • Monitor for unexpected kernel restarts after updates or under unusual ICMPv6 traffic volumes, and correlate them with patch status.

Limitations of the available information

  • The record has no title, so titles here are derived from the description.
  • The record does not include a proof of concept, exploitation timeline or threat actor information, and this analysis does not add any.
  • The source of the second CVSS score is not identified.
  • The record does not describe which Red Hat package builds correspond to each errata.
  • Fixed version boundaries are taken from the affected ranges in the record and were not verified against the upstream commits.

Frequently asked questions

What is the core defect in CVE-2026-53006?

The kernel description says the IPv6 ICMPv6 receive path cached source and destination addresses before pskb_pull(), which can change the buffer head. The fix removes those cached variables, and the defect is classified as CWE-416 use-after-free.

Is this CVE listed in CISA KEV?

No. The record shows KEV as not listed, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Inventory kernel versions against the affected ranges, apply the stable or distribution update for your branch, and reboot into the fixed kernel. For Red Hat Enterprise Linux, follow the referenced errata.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.