Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when certain virtual networking configurations (VRFs) are modified, leading to a system failure. This primarily impacts the availability of the server or device, potentially causing a denial-of-service.
Technical details
A NULL pointer dereference exists in the `ip6_rt_get_dev_rcu()` function within `net/ipv6/route.c`. The vulnerability is triggered when `l3mdev_master_dev_rcu()` returns NULL during the 'un-slaving' of a device from a VRF. A previous commit (4832c30d5458) removed a necessary fallback to the loopback device in the `ip6_rt_pcpu_alloc` path. A local attacker with sufficient privileges to modify network configurations or trigger specific routing lookups during device reconfiguration can cause a kernel panic (denial of service). The fix restores the explicit fallback to `loopback_dev` when the master device lookup returns NULL.
Affected products
- Linux Linux kernel 4.14 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-03-01: patched: Initial patch authored by Jakub Kicinski
- 2026-03-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee
- https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a
- https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f
- https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4
- https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34
- https://git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4
- https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e