The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=053d95ec2afe063e73fc8460584e7fd2a408f839
commit 053d95ec2afe063e73fc8460584e7fd2a408f839 Author: Vinícius Ferrão <[email protected]> AuthorDate: 2026-07-28 20:04:41 +0000 Commit: Pouria Mousavizadeh Tehrani <[email protected]> CommitDate: 2026-07-28 20:35:42 +0000 nd6: Set ip6 after m_pullup() in nd6_ra_input() nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then uses that pointer afterwards to set nd_ra. When m_pullup() relocates the chain it frees the original first mbuf and returns a new one, leaving ip6 dangling; the subsequent access may be a use-after-free read. The fix writes ip6 from the returned mbuf after m_pullup() inside the conditional if. Reviewed by: pouria Differential Revision: https://reviews.freebsd.org/D58229 --- sys/netinet6/nd6_rtr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c index 041fd25865ab..4004a23308d1 100644 --- a/sys/netinet6/nd6_rtr.c +++ b/sys/netinet6/nd6_rtr.c @@ -556,6 +556,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len) IP6STAT_INC(ip6s_exthdrtoolong); return; } + ip6 = mtod(m, struct ip6_hdr *); } nd_ra = (struct nd_router_advert *)((caddr_t)ip6 + off);
