{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46172", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.103Z", "datePublished": "2026-05-28T09:36:26.926Z", "dateUpdated": "2026-05-28T09:36:26.926Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-28T09:36:26.926Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm6: release dst on error in xfrm6_rcv_encap()\n\nxfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not\nalready have a dst attached. ip6_route_input_lookup() returns a\nreferenced dst entry even when the lookup resolves to an error route.\n\nIf dst->error is set, xfrm6_rcv_encap() drops the skb without attaching\nthe dst to the skb and without releasing the reference returned by the\nlookup. Repeated packets hitting this path therefore leak dst entries.\n\nRelease the dst before jumping to the drop path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/xfrm6_protocol.c"], "versions": [{"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7", "lessThan": "c2efc4956981066df2fef1cc77391b523db6d8e4", "status": "affected", "versionType": "git"}, {"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7", "lessThan": "554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13", "status": "affected", "versionType": "git"}, {"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7", "lessThan": "9d5047782f9bd2829e529df69209bf3232eb561f", "status": "affected", "versionType": "git"}, {"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7", "lessThan": "6a5eec0a2a0e99ec9743cf8f1c4082178811d90a", "status": "affected", "versionType": "git"}, {"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7", "lessThan": "bc0fcb9823cd0894934cf968b525c575833d7078", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/xfrm6_protocol.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.1-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c2efc4956981066df2fef1cc77391b523db6d8e4"}, {"url": "https://git.kernel.org/stable/c/554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13"}, {"url": "https://git.kernel.org/stable/c/9d5047782f9bd2829e529df69209bf3232eb561f"}, {"url": "https://git.kernel.org/stable/c/6a5eec0a2a0e99ec9743cf8f1c4082178811d90a"}, {"url": "https://git.kernel.org/stable/c/bc0fcb9823cd0894934cf968b525c575833d7078"}], "title": "ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm6: release dst on error in xfrm6_rcv_encap()\n\nxfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not\nalready have a dst attached. ip6_route_input_lookup() returns a\nreferenced dst entry even when the lookup resolves to an error route.\n\nIf dst->error is set, xfrm6_rcv_encap() drops the skb without attaching\nthe dst to the skb and without releasing the reference returned by the\nlookup. Repeated packets hitting this path therefore leak dst entries.\n\nRelease the dst before jumping to the drop path."}], "id": "CVE-2026-46172", "lastModified": "2026-05-28T13:44:01.663", "metrics": {}, "published": "2026-05-28T10:16:32.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a5eec0a2a0e99ec9743cf8f1c4082178811d90a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d5047782f9bd2829e529df69209bf3232eb561f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc0fcb9823cd0894934cf968b525c575833d7078"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c2efc4956981066df2fef1cc77391b523db6d8e4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()", "id": "2482644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482644"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's IPv6 (Internet Protocol version 6) xfrm6 component. When processing encapsulated IPv6 packets, the `xfrm6_rcv_encap()` function fails to release a destination (dst) entry reference if an IPv6 route lookup results in an error. A remote attacker could exploit this by sending repeated malformed IPv6 packets, leading to a continuous leak of dst entries and eventually causing a Denial of Service (DoS) due to resource exhaustion."], "name": "CVE-2026-46172", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46172\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46172\nhttps://lore.kernel.org/linux-cve-announce/2026052827-CVE-2026-46172-92e0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0146dca70b877b73c5fd9c67912b8a0ca8a7bac7,c2efc4956981066df2fef1cc77391b523db6d8e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0146dca70b877b73c5fd9c67912b8a0ca8a7bac7,554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0146dca70b877b73c5fd9c67912b8a0ca8a7bac7,9d5047782f9bd2829e529df69209bf3232eb561f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0146dca70b877b73c5fd9c67912b8a0ca8a7bac7,6a5eec0a2a0e99ec9743cf8f1c4082178811d90a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0146dca70b877b73c5fd9c67912b8a0ca8a7bac7,bc0fcb9823cd0894934cf968b525c575833d7078)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.8,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T12:15:21.823885+00:00", "updated": "2026-05-29T05:00:07.795946+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}