CVE-2026-89563

A flaw was found in the ip6tunnel module of the Linux kernel. Incorrect handling of socket buffers skb during headroom reallocation in the ip6tnlxmit function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller...

EUVD-2026-76474

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

CVE-2026-89563 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...