Re: [PATCH net] ipv6: fix fib6 walker UAF on NLM_F_REPLACE

From: Jakub Kicinski

Date: Mon Oct 19 2026 - 20:09:50 EST


On Sat, 10 Oct 2026 22:55:27 +0000 netdev-bot+sashiko@xxxxxxxxxx wrote:
> > + read_lock(&net->ipv6.fib6_walker_lock);
> > + FOR_WALKERS(net, w) {
> > + if (w->state == FWS_C && w->leaf == rt) {
> > + pr_debug("walker %p adjusted by unlink of %p\n", w, rt);
> > + w->leaf = next;
>
> [Severity: Medium]
> Should w->skip_in_node be reset here too?

Sounds legit on the surface
--
pw-bot: cr