CVE-2026-89563
Description
A flaw was found in the ip6_tunnel module of the Linux kernel. Incorrect handling of socket buffers (skb) during headroom reallocation in the ip6_tnl_xmit() function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller still holds a pointer to it, potentially allowing the same memory to be freed twice. This memory corruption issue could lead to a denial of service or potentially arbitrary code execution.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
