[SRU][Q][PATCH 0/1] CVE-2026-53006

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53006

[ Impact ]

icmpv6_rcv() cached the source and destination addresses in temporary variables
before calling pskb_pull(). Because pskb_pull() can reallocate skb->head, these
cached pointers could reference freed memory, leading to a use-after-free. This
affects the IPv6 ICMP receive path and could be triggered by crafted ICMPv6
packets.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick
xenial: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change would affect the IPv6 ICMP receive path,
potentially impacting handling or debug logging of ICMPv6 packets.