CVE-2026-98379

Received Received - Intake

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects in the FIB. An unprivileged user can construct this state with rtnetlink in a private user and network namespace, then trigger a NULL dereference through an IPv6 rpfilter lookup: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) Call Trace: ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316) nf_hook_slow (net/netfilter/core.c:619) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6216) process_backlog (net/core/dev.c:6680) __napi_poll (net/core/dev.c:7739) net_rx_action (net/core/dev.c:7959) handle_softirqs (kernel/softirq.c:622) do_softirq.part.0 (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:450) __dev_queue_xmit (net/core/dev.c:4913) packet_sendmsg (net/packet/af_packet.c:3139) __sys_sendto (net/socket.c:2252) __x64_sys_sendto (net/socket.c:2259) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Reject routes without an inet6_dev immediately after lookup. Such routes are not eligible for reverse-path filtering, and the check protects all later rt6i_idev dereferences.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98379

EUVD

EUVD-2026-95534

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	e26f9a480fb6c1b614660e824d69a74e2ce990f3
Linux	Linux	3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where an unprivileged user can trigger a NULL pointer dereference in the IPv6 reverse-path filtering (rpfilter) code. The issue occurs when routes without an inet6_dev (IPv6 network device) are incorrectly processed, leading to a kernel panic.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's IPv6 reverse-path filtering (rpfilter) module. Detection requires checking kernel logs for a general protection fault or NULL pointer dereference in the rpfilter_mt function. Monitor system logs for kernel panic messages or Oops reports related to IPv6 networking.

Impact Analysis

An attacker in a private user or network namespace could exploit this to crash the system by causing a kernel panic. This results in a denial of service (DoS) where the system becomes unresponsive.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel network filtering issue. The flaw involves a NULL pointer dereference in IPv6 reverse-path filtering, which could lead to kernel crashes but does not inherently involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch this vulnerability. If immediate patching is not possible, disable IPv6 reverse-path filtering (rpfilter) as a temporary workaround. Update firewall rules to restrict rtnetlink access in unprivileged user namespaces.

Hi! I’m here to help you understand CVE-2026-98379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70