CVE-2026-64538

Received Received - Intake

Null Pointer Dereference in Linux Kernel IPv6 Networking

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown() clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(), but this re-fetch is unguarded; nexthop-backed routes survive addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is nulled. Return 0 when idev is NULL, matching rt6_mtu_change_route() and the fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in fib6_mtu()."). Oops: general protection fault, ... KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6_nh_mtu_change+0x203/0x990 rt6_mtu_change_route+0x141/0x1d0 __fib6_clean_all+0xd0/0x160 rt6_mtu_change+0xb4/0x100 ndisc_router_discovery+0x24b5/0x2cb0 icmpv6_rcv+0x12e9/0x1710 ipv6_rcv+0x39b/0x410

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64538

EUVD

EUVD-2026-49589

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a null-pointer dereference vulnerability in the Linux kernel's IPv6 networking code. The issue occurs in the fib6_nh_mtu_change() function where it fetches the IPv6 device structure (idev) without checking if it is NULL before dereferencing it to access idev->cnf.mtu6. This can lead to a kernel oops (crash) when the device is being shut down.

Detection Guidance

This vulnerability involves a null-pointer dereference in the Linux kernel's IPv6 networking code. Detection requires checking kernel logs for a general protection fault or null-pointer dereference related to fib6_nh_mtu_change. Monitor system logs for Oops messages or KASAN errors indicating a null-ptr-deref in the IPv6 stack.

Impact Analysis

This vulnerability can cause system crashes (kernel oops) when IPv6 networking is active. An attacker could potentially trigger this by manipulating network interfaces or sending specific router advertisements, leading to denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability is a null-pointer dereference in the Linux kernel's IPv6 networking code. It does not directly relate to data protection, privacy, or security controls typically addressed by GDPR or HIPAA. The issue causes system crashes but does not expose or leak sensitive data.

Mitigation Strategies

Apply the latest Linux kernel security updates from your distribution vendor. If no patch is available, consider disabling IPv6 temporarily or restricting network interfaces until the fix is applied. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-64538. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70