Junglewise Threat Intelligence

CVE-2026-23304: Linux kernel NULL pointer dereference in IPv6 ip6_rt_get_dev_rcu

CVE-2026-23304 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when certain virtual networking configurations (VRFs) are modified, leading to a system failure. This primarily impacts the availability of the server or device, potentially causing a denial-of-service.

Technical details

A NULL pointer dereference exists in the `ip6_rt_get_dev_rcu()` function within `net/ipv6/route.c`. The vulnerability is triggered when `l3mdev_master_dev_rcu()` returns NULL during the 'un-slaving' of a device from a VRF. A previous commit (4832c30d5458) removed a necessary fallback to the loopback device in the `ip6_rt_pcpu_alloc` path. A local attacker with sufficient privileges to modify network configurations or trigger specific routing lookups during device reconfiguration can cause a kernel panic (denial of service). The fix restores the explicit fallback to `loopback_dev` when the master device lookup returns NULL.

Affected products

  • Linux Linux kernel 4.14 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7

Timeline

  • 2026-03-01: patched: Initial patch authored by Jakub Kicinski
  • 2026-03-25: disclosed: CVE published

References

Related threats