Linux kernel IPv6: heap overwrite into skb_shared_info via UDPv6 MSG_MORE with MSG_SPLICE_PAGES

Impact

On the paged-allocation branch of __ip6_append_data(), alloclen does not account for the fraggap bytes carried over from the previous skb, so the linear area is undersized by exactly that amount and the copy runs past skb->end into the trailing skb_shared_info. An unprivileged local user reaches this from a plain UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES, giving controlled corruption of adjacent kernel heap metadata - the usual starting point for local privilege escalation. This is host-kernel state, not per-container state, so any tenant workload that can open a UDPv6 socket sits one bug-chain away from breaking isolation for every GPU pod scheduled on that node. The record carries a KEV flag, which raises the urgency above the usual local-kernel triage.

Who can reach it

Local unprivileged user with the ability to open a UDPv6 socket - including inside a container, since no capability is required and the path is ordinary sendmsg() flag handling. No authentication beyond code execution on the node.

What to do

Update to a stable kernel containing the fix (the linked git.kernel.org commits) and reboot each node; the corrupted-accounting fix is in packet-path code that livepatching generally will not cover. On a GPU fleet this means draining and rebooting nodes, so batch it with the next kernel maintenance window unless the KEV listing forces it sooner. As a stopgap, blocking MSG_SPLICE_PAGES-capable workloads is not practical - restricting untrusted local code execution is the only real mitigation.

References

Related entries

• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-63881 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-63884 · Linux i915 GPU kernel driverHigh
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High