ZDI Discloses Two Linux Kernel IPv6 Use-After-Free Local Privilege Escalation Flaws (ZDI-26-623 and ZDI-26-683 / CVE-2026-72463)
The Zero Day Initiative published two use-after-free vulnerabilities in Linux kernel IPv6 code enabling local privilege escalation: ZDI-26-623 (IPv6 multicast routing, CVSS 8.8, no CVE named) and ZDI-26-683 (IPv6 VTI subsystem, CVSS 7.5, CVE-2026-72463);…
The Zero Day Initiative has published two advisories covering use-after-free vulnerabilities in the Linux kernel's IPv6 networking code, both enabling local privilege escalation. ZDI-26-623 (published September 9, 2026) describes a use-after-free in the IPv6 multicast routing implementation: a local attacker able to execute low-privileged code on an affected installation can exploit the flaw to escalate privileges. ZDI assigned it a CVSS score of 8.8, and the advisory names no CVE id. ZDI-26-683 (published September 14, 2026) covers a use-after-free in the Linux kernel's IPv6 VTI subsystem, rated CVSS 7.5 and tracked as CVE-2026-72463; however, exploitation requires first obtaining the ability to execute high-privileged code on the target system, which limits its practical impact. The two flaws are distinct — one resides in multicast routing and the other in the VTI subsystem, and they carry different privilege prerequisites (low-privileged versus high-privileged code execution). Neither advisory states that exploitation has been observed in the wild.
- ZDI-26-623 (published 2026-09-09): use-after-free in the Linux kernel IPv6 multicast routing implementation enabling local privilege escalation; ZDI-assigned CVSS score of 8.8.
- ZDI-26-623 requires the attacker to first execute low-privileged code on an affected installation; the advisory names no CVE id and does not state that exploitation has been observed.
- ZDI-26-683 (published 2026-09-14): use-after-free in the Linux kernel IPv6 VTI subsystem enabling local privilege escalation; ZDI-assigned CVSS score of 7.5; tracked as CVE-2026-72463.
- ZDI-26-683 requires pre-existing ability to execute high-privileged code on the target system, limiting its practical impact; no observed exploitation is reported.
- Neither advisory reports in-the-wild exploitation.
Coverage timelineoldest first · each row is one article
- · 6d agoZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability
ZDI Published Advisories· 42
ZDI-26-623 details a use-after-free in Linux kernel IPv6 multicast routing enabling local privilege escalation, rated CVSS 8.8.
- · 1d agoZDI-26-683: Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-72463, a CVSS 7.5 use-after-free in the Linux Kernel IPv6 VTI subsystem enabling privilege escalation.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-72463 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races. NVD description · AI analysis pending | 9.8 | <1% | — | — |