---
id: CVE-2026-68127
title: 'ila: reload IPv6 header after pskb_may_pull in checksum adjust'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ila: reload IPv6 header after pskb_may_pull in checksum adjust

  ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling
  pskb_may_pull(). On a non-linear …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    e451a904606c571f731ef7a06b3398619dce5300
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    1eadcb43893b897ade85ac5bf5c618054bc3c655
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    ba353caafb06ccee57b78d3254e3cebf1dea4a93
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    896a9512d0d83c2a4b357e5585b7b62a8e3f95c1
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    7097a0280b178237265681be66d1bef11d15894b
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    472aba2603ca74c4f7722cb0c0296942b0776b8d
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc
  - >-
    Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 <
    92d3817649df2b0b6a008a686c8275c88d7ef594
  - Linux 4.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:44:18.440814Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:58.280Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68127'
references:
  - url: 'https://git.kernel.org/stable/c/e451a904606c571f731ef7a06b3398619dce5300'
  - url: 'https://git.kernel.org/stable/c/1eadcb43893b897ade85ac5bf5c618054bc3c655'
  - url: 'https://git.kernel.org/stable/c/ba353caafb06ccee57b78d3254e3cebf1dea4a93'
  - url: 'https://git.kernel.org/stable/c/896a9512d0d83c2a4b357e5585b7b62a8e3f95c1'
  - url: 'https://git.kernel.org/stable/c/7097a0280b178237265681be66d1bef11d15894b'
  - url: 'https://git.kernel.org/stable/c/472aba2603ca74c4f7722cb0c0296942b0776b8d'
  - url: 'https://git.kernel.org/stable/c/c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc'
  - url: 'https://git.kernel.org/stable/c/92d3817649df2b0b6a008a686c8275c88d7ef594'
tags:
  - cve.org
epss: 0.00536
epssPercentile: 0.43957
ingestedAt: '2026-10-16T17:24:46.846Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ila: reload IPv6 header after pskb_may_pull in checksum adjust

ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling
pskb_may_pull(). On a non-linear skb whose transport header sits in a page
fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head()
and free the old skb head, leaving ip6h dangling; the following
get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator()
uses ip6h (and the iaddr derived from it) again after the csum-adjust
call and additionally writes the new locator through that pointer.

Impact: a remote IPv6 packet routed through a configured ILA
csum-adjust-transport route or receive-side mapping triggers a
slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or
mapping requires CAP_NET_ADMIN to configure, but trigger packets are
unauthenticated once it exists.

Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport()
before the csum-diff read. In ila_update_ipv6_locator() only the
ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in
that case alone before the destination-address write; the neutral-map
modes never pull and keep their cached pointers.

## Affected

- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < e451a904606c571f731ef7a06b3398619dce5300`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < 1eadcb43893b897ade85ac5bf5c618054bc3c655`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < ba353caafb06ccee57b78d3254e3cebf1dea4a93`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < 896a9512d0d83c2a4b357e5585b7b62a8e3f95c1`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < 7097a0280b178237265681be66d1bef11d15894b`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < 472aba2603ca74c4f7722cb0c0296942b0776b8d`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc`
- `Linux >= 33f11d16142b06588eedfc1dd8cf93790979a712 < 92d3817649df2b0b6a008a686c8275c88d7ef594`
- `Linux 4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.