{ "cveId": "CVE-2026-46260", "url": "https://patchblox.com/security/cve/CVE-2026-46260", "summary": "CVE-2026-46260 is fixed in 23 products on 1 platform, first by ALAS2023-2026-1543, released April 7, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node()", "description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node(). syzbot reported out-of-bound read in fib6_add_rt2node(). [0] When IPv6 route is created with RTA_NH_ID, struct fib6_info does not have the trailing struct fib6_nh. The cited commit started to check !iter-\u003Efib6_nh-\u003Efib_nh_gw_family to ensure that rt6_qualify_for_ecmp() will return false for iter. If iter-\u003Enh is not NULL, rt6_qualify_for_ecmp() returns false anyway. Let\u0027s check iter-\u003Enh before reading iter-\u003Efib6_nh and avoid OOB read. [0]: BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node\u002B0x349c/0x3500 net/ipv6/ip6_fib.c:1142 Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500 CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 \u002B ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: \u003CTASK\u003E dump_stack_lvl\u002B0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report\u002B0xba/0x230 mm/kasan/report.c:482 kasan_report\u002B0x117/0x150 mm/kasan/report.c:595 fib6_add_rt2node\u002B0x349c/0x3500 net/ipv6/ip6_fib.c:1142 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1363 [inline] fib6_add\u002B0x910/0x18c0 net/ipv6/ip6_fib.c:1531 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add\u002B0xde/0x1b0 net/ipv6/route.c:3957 inet6_rtm_newroute\u002B0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg\u002B0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb\u002B0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast\u002B0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg\u002B0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg\u002B0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg\u002B0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg\u002B0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64\u002B0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f RIP: 0033:0x7f9316b9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003C48\u003E 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8809b678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9316e15fa0 RCX: 00007f9316b9aeb9 RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000003 RBP: 00007f9316c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9316e15fac R14: 00007f9316e15fa0 R15: 00007f9316e15fa0 \u003C/TASK\u003E Allocated by task 5499: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track\u002B0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc\u002B0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof\u002B0x40c/0x7e0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] fib6_info_alloc\u002B0x30/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create\u002B0x142/0x860 net/ipv6/route.c:3820 ip6_route_add\u002B0x49/0x1b0 net/ipv6/route.c:3949 inet6_rtm_newroute\u002B0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg\u002B0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb\u002B0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast\u002B0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg\u002B0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg\u002B0xa68/0xad0 net/socket.c:2592 ___sys_s ---truncated---", "published": "2026-04-07T09:00:00Z", "severity": "high", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.0012, "epssPercentile": 0.01819, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.12.77-99.140", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-devel", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-headers", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-libbpf", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-libbpf-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-libbpf-devel", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-libbpf-static", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-tools", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "kernel6.12-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.85-1", "fix": "DEBIAN-CVE-2026-46260", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46260", "released": "2026-06-24T14:07:24Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.18.14-1", "fix": "DEBIAN-CVE-2026-46260", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46260", "released": "2026-06-24T14:07:24Z" }, { "platform": "linux", "product": "perf6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "perf6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.77-99.140.amzn2023", "fix": "ALAS2023-2026-1543", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1543", "released": "2026-04-07T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }