CVE-2026-46172

MediumCVSS 5.5/10Last modified Nov 10, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()

xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6_route_input_lookup() returns a referenced dst entry even when the lookup resolves to an error route.

If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching the dst to the skb and without releasing the reference returned by the lookup. Repeated packets hitting this path therefore leak dst entries.

Release the dst before jumping to the drop path.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < a0721bcd72641c32b281f227a94505b31cf54117; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < a20b34f6e854fe6f2aa82528fae7a88759919eb4; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < 870560015ce6e0d8f841c6a8aba33c44be52c727; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < c2efc4956981066df2fef1cc77391b523db6d8e4; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < 554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < 9d5047782f9bd2829e529df69209bf3232eb561f; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < 6a5eec0a2a0e99ec9743cf8f1c4082178811d90a; >= 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7, < bc0fcb9823cd0894934cf968b525c575833d7078
LinuxLinux5.8
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.7, < *
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.7, < *

References

Timeline

Published
May 28, 2026
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-461737.8In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiCVE-2026-461748.8In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's oCVE-2026-461757.1In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by FGGC of node block During FGGC CVE-2026-461767.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mCVE-2026-461777.5In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver woulCVE-2026-461787.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Sashiko CVE-2026-461795.5In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Don't allow pointer operations on unconfigured streams WhenCVE-2026-461807.8In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdCVE-2026-461817.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out tCVE-2026-461825.5In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace TheCVE-2026-461837.8In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock damCVE-2026-461845.5In the Linux kernel, the following vulnerability has been resolved: sound: ua101: fix division by zero at probe Add a missing sanity check