{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-28T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()",
    "id" : "2482614",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2482614"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-763",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nip6_gre: Use cached t->net in ip6erspan_changelink().\nAfter commit 5e72ce3e3980 (\"net: ipv6: Use link netns in newlink() of\nrtnl_link_ops\"), ip6erspan_newlink() correctly resolves the per-netns\nip6gre hash via link_net. ip6erspan_changelink() was not converted in\nthat series and still uses dev_net(dev), which diverges from the\ndevice's creation netns after IFLA_NET_NS_FD migration.\nThis re-inserts the tunnel into the wrong per-netns hash. The\noriginal netns keeps a stale entry. When that netns is later\ndestroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a\nslab-use-after-free reported by KASAN, followed by a kernel BUG at\nnet/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net).\nip6gre_changelink() earlier in the same file already uses the cached\nt->net; only ip6erspan_changelink() has the wrong shape.", "A flaw was found in the Linux kernel's ip6_gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspan_changelink() function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original network namespace is destroyed, potentially resulting in a kernel bug and system instability or denial of service." ],
  "statement" : "ip6erspan_changelink used dev_net(dev) instead of the cached tunnel net namespace, so after IFLA_NET_NS_FD migration the tunnel could be reinserted into the wrong per netns ip6gre hash while a stale entry remained in the original namespace. Destroying that namespace later can walk the stale entry and trigger a slab use-after-free followed by a kernel BUG in unregister_netdevice_many_notify. For the CVSS the PR:L is used for the paranoid score because the commit states this is reachable from an unprivileged user namespace using unshare with user and net namespaces, not only from full host root. The issue is not directly network reachable by packet traffic and is triggered through local netlink namespace and tunnel lifecycle operations.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:61887",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.50.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-09-02T00:00:00Z",
    "advisory" : "RHSA-2026:62609",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "kernel-0:6.12.0-55.102.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57254",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.157.1.rt7.498.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57253",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.157.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-46120\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46120\nhttps://lore.kernel.org/linux-cve-announce/2026052815-CVE-2026-46120-1a01@gregkh/T" ],
  "name" : "CVE-2026-46120",
  "csaw" : false
}