CVE-2026-46260

HIGHPre-NVD 7.87.8—
EchelonGraph scoreMEDIUM confidence

Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2026-06-03. the CNA's CVSS baseline 7.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: cna:linux, epss, ghsa
Trending — 5 sources updated this week
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.8Exploit: None knownExposed: 0

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix out-of-bound access in fib6_add_rt2node().

syzbot reported out-of-bound read in fib6_add_rt2node(). [0]

When IPv6 route is created with RTA_NH_ID, struct fib6_info does not have the trailing struct fib6_nh.

The cited commit started to check !iter->fib6_nh->fib_nh_gw_family to ensure that rt6_qualify_for_ecmp() will return false for iter.

If iter->nh is not NULL, rt6_qualify_for_ecmp() returns false anyway.

Let's check iter->nh before reading iter->fib6_nh and avoid OOB read.

[0]: BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500

CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1363 [inline] fib6_add+0x910/0x18c0 net/ipv6/ip6_fib.c:1531 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3957 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9316b9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8809b678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9316e15fa0 RCX: 00007f9316b9aeb9 RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000003 RBP: 00007f9316c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9316e15fac R14: 00007f9316e15fa0 R15: 00007f9316e15fa0

Allocated by task 5499: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] fib6_info_alloc+0x30/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x142/0x860 net/ipv6/route.c:3820 ip6_route_add+0x49/0x1b0 net/ipv6/route.c:3949 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_s ---truncated---

CVSS v3
7.8
EG Score
7.8(medium)
EG Risk
40(Track)
EG Risk 40/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity78% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
2%
KEV
Not listed

Published

June 3, 2026

Last Modified

August 5, 2026

Advisory Details (5)

Auto-updated Jun 5, 2026
No patch confirmed yet.
generic

ipv6: Fix out-of-bound access in fib6_add_rt2node(). - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/bf5009a06e03ee9a51052bb59f2228a5e4e66260
generic

ipv6: Fix out-of-bound access in fib6_add_rt2node(). - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/bcc60ad129ae1837cf809c81bff56ec8bfdb6b11
generic

ipv6: Fix out-of-bound access in fib6_add_rt2node(). - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/8244f959e2c125c849e569f5b23ed49804cce695
generic

ipv6: Fix out-of-bound access in fib6_add_rt2node(). - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/500e54615c97bc3c427e52305a6fcd38a0e008a3
generic

ipv6: Fix out-of-bound access in fib6_add_rt2node(). - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/03b5051e02f5a3772eee57493ad697d4b505b0c2

Vendor Advisories for CVE-2026-46260(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(12)

Vendor / EcosystemFixed in / PatchReleasedSource
ubuntulinux-virtual-6.8 (6.8.0-134.134) @ noble2026-09-14ubuntu
ubuntulinux-tools-nvidia-lowlatency-64k-6.8 (6.8.0-1058.61.1) @ noble2026-09-14ubuntu
ubuntulinux-tools-nvidia-tegra-rt-6.8 (6.8.0-1029.30) @ noble2026-09-14ubuntu
ubuntulinux-tools-lowlatency-hwe-20.04-edge (6.8.0-134.134.1) @ noble2026-09-14ubuntu
ubuntulinux-tools-raspi-realtime-6.8 (6.8.0-2049.50) @ noble2026-09-14ubuntu
ubuntulinux-tools-raspi-6.8 (6.8.0-1060.64) @ noble2026-09-14ubuntu
ubuntulinux-tools-fips-6.8 (6.8.0-134.134+fips1) @ noble2026-09-14ubuntu
ubuntulinux-tools-azure-lts-24.04 (6.8.0-1063.71) @ noble2026-09-14ubuntu
ubuntulinux-tools-azure-fde-lts-24.04 (6.8.0-1062.69) @ noble2026-09-14ubuntu
ubuntulinux-tools-azure-fde-6.8 (6.8.0-1062.69~22.04.1) @ jammy2026-09-14ubuntu
ubuntulinux-virtual-hwe-22.04-edge (6.8.0-136.136~22.04.1) @ jammy2026-09-14ubuntu
linuxKernel @ 6.6.128—osv

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Affected Packages

(2 across 2 ecosystems)
Debian:13(1)
PackageVulnerable rangeFixed inDependents
linux6.12.38-1 ... 6.12.85-1~bpo12+1 (17 versions)6.12.85-1—
Debian:14(1)
PackageVulnerable rangeFixed inDependents
linux6.12.100-1 ... 6.18~rc7-1~exp1 (103 versions)6.18.14-1—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

All Vendor Advisories

(11)

Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.

Data Freshness Timeline

(refreshed 10× in last 7d / 45× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

Showing the most recent 100 of 275 total refreshes for this CVE.

  1. 2026-09-16 05:15 UTCEPSS rescore
  2. 2026-09-14 05:33 UTCEG score recompute
  3. 2026-09-14 05:33 UTCVendor advisory
  4. 2026-09-14 05:33 UTCGHSA enrichment
  5. 2026-09-13 16:47 UTCEPSS rescore
  6. 2026-09-12 23:36 UTCOSV refresh
  7. 2026-09-12 15:01 UTCEPSS rescore
  8. 2026-09-11 14:53 UTCEPSS rescore
  9. 2026-09-11 09:37 UTCEPSS rescore
  10. 2026-09-10 09:34 UTCEPSS rescore
  11. 2026-09-08 22:00 UTCEPSS rescore
  12. 2026-09-07 16:01 UTCEPSS rescore
  13. 2026-09-06 13:47 UTCEPSS rescore
  14. 2026-09-04 05:06 UTCEPSS rescore
  15. 2026-09-02 14:12 UTCEPSS rescore
  16. 2026-09-01 13:54 UTCEPSS rescore
  17. 2026-08-30 19:17 UTCEPSS rescore
  18. 2026-08-28 21:41 UTCEPSS rescore
  19. 2026-08-27 14:25 UTCEPSS rescore
  20. 2026-08-26 14:46 UTCEPSS rescore
  21. 2026-08-25 03:38 UTCEG score recompute
  22. 2026-08-25 03:38 UTCVendor advisory
  23. 2026-08-25 03:38 UTCGHSA enrichment
  24. 2026-08-24 00:20 UTCVendor advisory
  25. 2026-08-24 00:20 UTCGHSA enrichment
Show 75 more
  1. 2026-08-23 12:48 UTCEG score recompute
  2. 2026-08-23 12:48 UTCVendor advisory
  3. 2026-08-23 12:48 UTCGHSA enrichment
  4. 2026-08-23 00:19 UTCEPSS rescore
  5. 2026-08-21 23:49 UTCEPSS rescore
  6. 2026-08-21 14:41 UTCEG score recompute
  7. 2026-08-21 14:41 UTCVendor advisory
  8. 2026-08-21 14:41 UTCGHSA enrichment
  9. 2026-08-20 22:55 UTCEPSS rescore
  10. 2026-08-20 21:33 UTCVendor advisory
  11. 2026-08-20 21:33 UTCGHSA enrichment
  12. 2026-08-20 10:01 UTCEG score recompute
  13. 2026-08-20 10:01 UTCVendor advisory
  14. 2026-08-20 10:01 UTCGHSA enrichment
  15. 2026-08-19 17:04 UTCEPSS rescore
  16. 2026-08-18 13:48 UTCEPSS rescore
  17. 2026-08-17 15:48 UTCEG score recompute
  18. 2026-08-17 15:48 UTCVendor advisory
  19. 2026-08-17 15:48 UTCGHSA enrichment
  20. 2026-08-17 13:47 UTCEPSS rescore
  21. 2026-08-17 03:45 UTCEG score recompute
  22. 2026-08-17 03:45 UTCVendor advisory
  23. 2026-08-17 03:45 UTCGHSA enrichment
  24. 2026-08-16 14:56 UTCEPSS rescore
  25. 2026-08-16 14:56 UTCVendor advisory
  26. 2026-08-16 14:56 UTCGHSA enrichment
  27. 2026-08-16 02:17 UTCEG score recompute
  28. 2026-08-16 02:17 UTCVendor advisory
  29. 2026-08-16 02:17 UTCGHSA enrichment
  30. 2026-08-16 02:14 UTCEPSS rescore
  31. 2026-08-15 14:43 UTCEG score recompute
  32. 2026-08-15 14:43 UTCVendor advisory
  33. 2026-08-15 14:43 UTCGHSA enrichment
  34. 2026-08-15 01:30 UTCEPSS rescore
  35. 2026-08-14 22:12 UTCVendor advisory
  36. 2026-08-14 22:12 UTCGHSA enrichment
  37. 2026-08-14 10:29 UTCVendor advisory
  38. 2026-08-14 10:29 UTCGHSA enrichment
  39. 2026-08-13 22:57 UTCEG score recompute
  40. 2026-08-13 22:57 UTCVendor advisory
  41. 2026-08-13 22:57 UTCGHSA enrichment
  42. 2026-08-13 22:00 UTCEPSS rescore
  43. 2026-08-13 08:22 UTCVendor advisory
  44. 2026-08-13 08:21 UTCGHSA enrichment
  45. 2026-08-12 20:49 UTCEG score recompute
  46. 2026-08-12 20:49 UTCVendor advisory
  47. 2026-08-12 20:49 UTCGHSA enrichment
  48. 2026-08-12 13:51 UTCEPSS rescore
  49. 2026-08-12 09:17 UTCVendor advisory
  50. 2026-08-12 09:17 UTCGHSA enrichment
  51. 2026-08-11 21:42 UTCEG score recompute
  52. 2026-08-11 21:42 UTCVendor advisory
  53. 2026-08-11 21:42 UTCGHSA enrichment
  54. 2026-08-11 10:10 UTCEG score recompute
  55. 2026-08-11 10:10 UTCVendor advisory
  56. 2026-08-11 10:10 UTCGHSA enrichment
  57. 2026-08-11 00:00 UTCEPSS rescore
  58. 2026-08-10 22:38 UTCVendor advisory
  59. 2026-08-10 22:38 UTCGHSA enrichment
  60. 2026-08-10 09:18 UTCVendor advisory
  61. 2026-08-10 09:17 UTCGHSA enrichment
  62. 2026-08-09 21:45 UTCEG score recompute
  63. 2026-08-09 21:45 UTCVendor advisory
  64. 2026-08-09 21:45 UTCGHSA enrichment
  65. 2026-08-09 13:46 UTCEPSS rescore
  66. 2026-08-09 10:13 UTCVendor advisory
  67. 2026-08-09 10:13 UTCGHSA enrichment
  68. 2026-08-08 22:41 UTCEG score recompute
  69. 2026-08-08 22:41 UTCVendor advisory
  70. 2026-08-08 22:41 UTCGHSA enrichment
  71. 2026-08-08 16:37 UTCEPSS rescore
  72. 2026-08-08 11:06 UTCVendor advisory
  73. 2026-08-08 11:06 UTCGHSA enrichment
  74. 2026-08-07 23:33 UTCVendor advisory
  75. 2026-08-07 23:33 UTCGHSA enrichment

Frequently asked(5)

What is CVE-2026-46260?
CVE-2026-46260 is a high vulnerability published on June 3, 2026. In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6addrt2node(). syzbot reported out-of-bound read in fib6addrt2node(). [0] When IPv6 route is created with RTANHID, struct fib6_info does not have the trailing struct fib6_nh. The cited commit…
When was CVE-2026-46260 disclosed?
CVE-2026-46260 was first published in the National Vulnerability Database on June 3, 2026, with the most recent update on August 5, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-46260 actively exploited?
CVE-2026-46260 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 97.9% of all scored CVEs.
What is the CVSS score of CVE-2026-46260?
CVE-2026-46260 has a CVSS v4.0 base score of 7.8 (CNA self-assessment; NVD's own analysis pending).
How do I remediate CVE-2026-46260?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-46260, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-46260

Explore →

Is Your Infrastructure Affected by CVE-2026-46260?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs