Description
Memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge2 | DSA-1018-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge2 | DSA-1017-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +6 | 2.6.9-22.0.2.EL | RHSA-2006:0101 |
| RHEL 3 | kernel +8 | 2.4.21-37.0.1.EL | RHSA-2006:0140 |
Advisories 4
- RHSA-2006:0140 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0101 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1017-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1018-1 kernel-source-2.4.27 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2006:0140 vendor-advisory
- 19038 third-party-advisory
- 16043 vdb-entry
- 19369 third-party-advisory
- 18203 third-party-advisory
- RHSA-2006:0101 vendor-advisory
- [linux-kernel] 20050829 Re: Linux 2.6.12.6 mailing-list
- DSA-1018 vendor-advisory
- 18510 third-party-advisory
- SUSE-SA:2006:012 vendor-advisory
- [linux-kernel] 20050826 [PATCH 7/7] [IPV6]: Fix SKB leak in ip6_input_finish() mailing-list
- oval:org.mitre.oval:def:9396 vdb-entry signature
- DSA-1017 vendor-advisory
- 19374 third-party-advisory
- USN-231-1 vendor-advisory
- 18562 third-party-advisory