CVE-2026-64542

Received Received - Intake

NULL dereference in Linux kernel IPv6 ndisc

Publication date: 2026-07-27

Last updated on: 2026-08-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check, even though its only caller ndisc_recv_na() already fetched and NULL-checked idev for the same device. Both reads of dev->ip6_ptr run in the same RCU read-side critical section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchronize_net() that orders the unregister path, so the re-fetch returns NULL and oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974) Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndisc_recv_na (net/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_input.c:534) ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_input.c:635) ipv6_rcv (net/ipv6/ip6_input.c:351) </IRQ> It is reachable by an unprivileged user via a network namespace. Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev->ip6_ptr has been cleared.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-03

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64542

EUVD

EUVD-2026-49593

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 network stack. It occurs in the accept_untracked_na() function when processing IPv6 Neighbor Advertisement messages. The function re-fetches the network device structure without checking if it's NULL, even though the caller already validated it. A race condition during network interface shutdown can clear the device pointer between checks, causing a kernel crash (oops).

Detection Guidance

This vulnerability is a kernel-level issue in the Linux IPv6 network stack. Detection requires checking kernel logs for NULL pointer dereference errors in ndisc_recv_na or related IPv6 network functions. Use commands like 'dmesg | grep -i null' or 'journalctl -k | grep -i null' to search for kernel errors. If you suspect exploitation, monitor for crashes in network-related processes or kernel panics.

Impact Analysis

An unprivileged user in a network namespace could trigger this flaw to crash the Linux kernel, causing a denial of service on the affected system. The vulnerability doesn't allow code execution or data theft but can make the system unresponsive until rebooted.

Compliance Impact

This vulnerability is a NULL pointer dereference in the Linux kernel's IPv6 network handling. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, as it is a system-level network issue rather than a data exposure or access control flaw.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, consider disabling IPv6 temporarily via 'sysctl -w net.ipv6.conf.all.disable_ipv6=1' or 'sysctl -w net.ipv6.conf.default.disable_ipv6=1'. Restrict unprivileged user access to network namespaces if possible. Monitor kernel logs for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-64542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70