CVE-2026-43099
Awaiting Analysis Awaiting Analysis - Queue
Null-Pointer Dereference in Linux Kernel ICMP Probe

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing this error pointer to dev_hold() will cause a kernel crash with null-ptr-deref. Instead, silently discard the request. RFC 8335 does not appear to define a specific response for the case where an IPv6 interface identifier is syntactically valid but the implementation cannot perform the lookup at runtime, and silently dropping the request may safer than misreporting "No Such Interface".
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
CVE-2026-43099
EUVD
EUVD-2026-27608
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's handling of certain IPv6 operations. Specifically, when the IPv6 stack is not active (for example, when CONFIG_IPV6 is set to 'm' and the module is not loaded), a function called ipv6_dev_find() may return an error pointer ERR_PTR(-EAFNOSUPPORT). If this error pointer is then passed to another function dev_hold(), it causes a kernel crash due to a null pointer dereference.

The fix involves silently discarding the request instead of passing the error pointer, as the relevant RFC (RFC 8335) does not define a specific response for this scenario. This approach avoids misreporting errors and prevents the kernel crash.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel to crash due to a null pointer dereference when handling certain IPv6 interface lookups while the IPv6 stack is inactive. Such a crash can lead to system instability, denial of service, or unexpected reboots, potentially disrupting services running on affected systems.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart