{"cve":"CVE-2026-72429","nvd":{"published":"2026-08-15T06:22:16.770","modified":"2026-08-17T06:19:10.243","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix type confusion of dst_entry\n\nIOAM uses a dummy dst_entry(null_dst) to mark that the destination should\nnot be changed after the transformation. This dst is stored in the IOAM lwt\nstate and may be passed to dst_cache_set_ip6().\n\nHowever, the IPv6 dst cache path eventually calls rt6_get_cookie(), which\ntreats the dst_entry as part of a struct rt6_info. Since the null_dst was\nembedded directly as a struct dst_entry in struct ioam6_lwt, this resulted\nin an invalid cast and rt6_get_cookie() reading fields from the wrong\nobject.\n\nIn practice, the wrong cookie is not used while dst->obsolete is zero, but\nrt6_get_cookie() may also access per-cpu value when rt->sernum is\nzero. In this case, rt->sernum aliases ioam6_lwt::cache::reset_ts, which\ncan become zero, making this a potential invalid pointer access.\n\nFix this by embedding a full struct rt6_info for the dummy IPv6 route and\npassing its dst member to the dst APIs.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":[],"references":["https://git.kernel.org/stable/c/5a3b2ee1e96d0580a8ed8deda6dfa430604f9ab0","https://git.kernel.org/stable/c/9ed19e11d2146076d117d51a940643990118449b","https://git.kernel.org/stable/c/ea24f911ead85ba3d570a31e37c52b6c949f6928"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72429","score":0.00649,"percentile":0.51139,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}