CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink().

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • c6d72628352c949629af619b77b042e0fb5245e7, 4.17affected
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before 7bd0f2b162b426b343a114e1b329f0d8d14fdc6eaffected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before 01b71ff2857d3598337de11e7840a8e3ff21553caffected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before 0fcf6731706f73494245a9c0d64f93bebf95bb51affected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before eca62bb0569de4d43a4dac06a2092a9d4ca1d702affected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before 311fdd26eb4443d43b909cc67a10f3a5fd1b21b2affected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82affected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before cf7fc624329e76c6394653d12353e1d033adea91affected · git
  • 2d665034f239412927b1e71329f20f001c92da09 and later · before 1d324c2f43f70c965f25c58cc3611c779adbe47eaffected · git
  • 4.16.12 and later · before 4.17affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-46118May 28, 2026 · pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
  22Monitor
• ← EarlierCVE-2026-46119May 28, 2026 · libceph: Fix slab-out-of-bounds access in auth message processing
  36Monitor
• Later →CVE-2026-46121May 28, 2026 · mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
  31Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.