Junglewise Threat Intelligence

CVE-2026-23300: Linux Kernel NULL pointer dereference in IPv6 nexthop routing

CVE-2026-23300 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component can cause the entire system to crash (kernel panic). This occurs when specific network routing configurations involving IPv6 loopback addresses are used by IPv4 traffic. An attacker with local access could exploit this to disrupt operations and cause a denial of service.

Technical details

A NULL pointer dereference exists in the Linux kernel's net/ipv6/route.c component. When a standalone IPv6 nexthop object is created using a loopback device, the fib6_nh_init() function misclassifies it as a reject route because it lacks a destination prefix. This misclassification causes the kernel to skip the fib_nh_common_init() function, leaving the nhc_pcpu_rth_output pointer unallocated. If an IPv4 route subsequently attempts to reference this nexthop, the __mkroute_output() function dereferences the NULL pointer, resulting in a kernel panic. The fix involves simplifying the check in fib6_nh_init() to only match explicit reject routes (RTF_REJECT), ensuring proper memory allocation for standalone nexthop objects.

Affected products

  • Linux Linux Kernel 5.3 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1, 7.0-rc2

Timeline

  • 2026-03-25: disclosed: Initial disclosure of the vulnerability
  • 2026-03-25: advisory: CVE-2026-23300 published
  • 2026-03-05: patched: Fix committed to the main Linux kernel tree

References