CVE-2026-23304
Received Received - Intake
Null Pointer Dereference in Linux Kernel IPv6 Routing Component

Publication date: 2026-03-25

Last updated on: 2026-04-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-04-18
Generated
2026-05-07
AI Q&A
2026-03-25
EPSS Evaluated
2026-05-05
NVD
CVE-2026-23304
EUVD
EUVD-2026-15242
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a NULL pointer dereference in the Linux kernel's IPv6 networking code, specifically in the function ip6_rt_get_dev_rcu().

The issue arises because the function l3mdev_master_dev_rcu() can return NULL when a slave device is being un-slaved from a VRF (Virtual Routing and Forwarding). While other callers handle this NULL return properly, the fallback to the loopback device was lost in ip6_rt_pcpu_alloc() leading to a potential NULL pointer dereference.

This can cause the kernel to attempt to access memory through a NULL pointer, which typically results in a crash or kernel panic.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel to crash or panic due to a NULL pointer dereference in the IPv6 routing code.

Such crashes can lead to denial of service (DoS) conditions, making the affected system unstable or unavailable until it is rebooted or the issue is resolved.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart