Junglewise Threat Intelligence

CVE-2026-23293: Linux kernel NULL pointer dereference in VXLAN with IPv6 disabled

CVE-2026-23293 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's VXLAN networking component that can cause a system crash. When a system is configured to disable IPv6 at boot, certain internal networking tables are not set up. If an IPv6 packet is then processed by the VXLAN interface, the system attempts to access these uninitialized tables, leading to a kernel panic and service outage.

Technical details

A NULL pointer dereference exists in the VXLAN driver (vxlan_core.c) within the route_shortcircuit() function. When the Linux kernel is booted with 'ipv6.disable=1', the Neighbor Discovery table (nd_tbl) is never initialized because inet6_init() returns early. If an IPv6 packet is subsequently injected into a VXLAN interface, route_shortcircuit() calls neigh_lookup() using the uninitialized nd_tbl, resulting in a kernel Oops. The fix introduces an explicit check for the initialization of ipv6_stub->nd_tbl before proceeding with IPv6 short-circuit routing. This affects systems where VXLAN is used and IPv6 is disabled at the kernel level.

Affected products

  • Linux Linux kernel 3.12 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7

Timeline

  • 2026-03-04: patched: Initial patch authored by Fernando Fernandez Mancera
  • 2026-03-25: advisory: CVE-2026-23293 published

References