CVE-2026-68336
Received Received - Intake

NULL Pointer Dereference in Linux Kernel Bonding Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconf_all NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route(). BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by adding ipv6_mod_enabled() condition check in the caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68336
EUVD
EUVD-2026-55437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when booting with the 'ipv6.disable=1' parameter. It causes a NULL dereference in the bonding driver when IPv6 is disabled but the system still attempts to send IPv6-related operations. The issue arises because devconf_all is not initialized when IPv6 is disabled, leading to a crash in functions like ip6_pol_route.

Detection Guidance

This vulnerability occurs when the Linux kernel is booted with 'ipv6.disable=1' and triggers a NULL pointer dereference in the bonding driver. Detection requires checking kernel logs for NULL pointer dereference errors related to bonding or IPv6. Look for messages like 'kernel NULL pointer dereference' in /var/log/kern.log or dmesg output.

Impact Analysis

This vulnerability can cause a kernel crash (NULL pointer dereference) when the system boots with IPv6 disabled and uses the bonding driver. This results in a system failure or reboot, potentially causing downtime or data loss if not addressed.

Mitigation Strategies

Apply the kernel patch that adds the ipv6_mod_enabled() condition check in bond_send_validate(). Alternatively, avoid booting with 'ipv6.disable=1' if IPv6 is not required. Ensure your kernel version includes the fix for CVE-2026-68336.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68336. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart