CVE-2026-64116

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel IPv6 IOAM

Publication date: 2026-07-19

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-12

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64116

EUVD

EUVD-2026-45801

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.15 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference issue in the Linux kernel's IPv6 IOAM (In-situ Operations, Administration, and Maintenance) implementation. The function ipv6_hop_ioam() fails to validate the idev pointer obtained from __in6_dev_get(skb->dev)->cnf.ioam6_enabled. During interface teardown, addrconf_ifdown() can clear dev->ip6_ptr via RCU, causing __in6_dev_get() to return NULL. This leads to a crash when processing an IOAM Hop-by-Hop option.

Detection Guidance

This vulnerability may not have direct detection commands as it involves a NULL pointer dereference in the Linux kernel's IPv6 IOAM handling. Monitor kernel logs for NULL pointer dereference errors or crashes related to IPv6 IOAM processing. Check for kernel oops messages or system crashes during IPv6 traffic processing.

Impact Analysis

This vulnerability can cause a kernel crash (NULL pointer dereference) when processing IPv6 packets with IOAM Hop-by-Hop options on affected systems. This may lead to denial of service, system instability, or potential remote code execution if exploited maliciously.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving a NULL pointer dereference in IPv6 IOAM processing, which could lead to system crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, consider disabling IPv6 IOAM functionality or restricting IPv6 traffic until the patch is applied. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-64116. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70