]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ipv6: fix potential UAF caused by ip6_forward_proxy_check()
authorEric Dumazet <edumazet@google.com>
Tue, 5 May 2026 13:00:56 +0000 (13:00 +0000)
committerJakub Kicinski <kuba@kernel.org>
Thu, 7 May 2026 00:29:23 +0000 (17:29 -0700)
commit7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1
treea32967d41a88fefdc7f1694b3d5ed4b6f636dbc5
parent0e1368a28dd5231ae0dbe240dfe0ff2657de5647
ipv6: fix potential UAF caused by ip6_forward_proxy_check()

ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
skb->head.

Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
the freed memory.

Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv6/ip6_output.c