CVE-2026-64116
Received Received - Intake

NULL Pointer Dereference in Linux Kernel IPv6 IOAM

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64116
EUVD
EUVD-2026-45801

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference issue in the Linux kernel's IPv6 IOAM (In-situ Operations, Administration, and Maintenance) implementation. The function ipv6_hop_ioam() fails to validate the idev pointer obtained from __in6_dev_get(skb->dev)->cnf.ioam6_enabled. During interface teardown, addrconf_ifdown() can clear dev->ip6_ptr via RCU, causing __in6_dev_get() to return NULL. This leads to a crash when processing an IOAM Hop-by-Hop option.

Detection Guidance

This vulnerability may not have direct detection commands as it involves a NULL pointer dereference in the Linux kernel's IPv6 IOAM handling. Monitor kernel logs for NULL pointer dereference errors or crashes related to IPv6 IOAM processing. Check for kernel oops messages or system crashes during IPv6 traffic processing.

Impact Analysis

This vulnerability can cause a kernel crash (NULL pointer dereference) when processing IPv6 packets with IOAM Hop-by-Hop options on affected systems. This may lead to denial of service, system instability, or potential remote code execution if exploited maliciously.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving a NULL pointer dereference in IPv6 IOAM processing, which could lead to system crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, consider disabling IPv6 IOAM functionality or restricting IPv6 traffic until the patch is applied. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart