netdev - Re: [PATCH v1 net] ipv6: Fix use-after-free in inet6_addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89iKb1gasQifwoiebUOWgEL-dY=_iHR-EMprmpw5E5NJ=zg@mail.gmail.com>
Date: Tue, 13 Jan 2026 09:47:58 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Kuniyuki Iwashima <kuniyu@...gle.com>
Cc: "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	Hangbin Liu <liuhangbin@...il.com>, Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org, 
	syzbot+72e610f4f1a930ca9d8a@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net] ipv6: Fix use-after-free in inet6_addr_del().

On Tue, Jan 13, 2026 at 2:05 AM Kuniyuki Iwashima <kuniyu@...gle.com> wrote:
>
> syzbot reported use-after-free of inet6_ifaddr in
> inet6_addr_del(). [0]
>
> The cited commit accidentally moved ipv6_del_addr() for
> mngtmpaddr before reading its ifp->flags for temporary
> addresses in inet6_addr_del().
>
> Let's move ipv6_del_addr() down to fix the UAF.
>

> Fixes: 00b5b7aab9e42 ("net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged")
> Reported-by: syzbot+72e610f4f1a930ca9d8a@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/696598e9.050a0220.3be5c5.0009.GAE@google.com/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>
> ---

Reviewed-by: Eric Dumazet <edumazet@...gle.com>