Junglewise Threat Intelligence

CVE-2026-23381: Linux Kernel NULL pointer dereference in net bridge

CVE-2026-23381 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's network bridge component can cause a system crash when IPv6 is disabled via boot parameters. If a specific network discovery packet reaches a bridge with neighbor suppression enabled, the system may experience a kernel panic (NULL pointer dereference). This results in a complete loss of availability for the affected system, potentially disrupting network operations and industrial control processes.

Technical details

A NULL pointer dereference exists in the Linux kernel bridge driver within the br_do_suppress_nd() function. When the kernel is booted with 'ipv6.disable=1', the Neighbor Discovery table (nd_tbl) is never initialized, leaving the ipv6_stub->nd_tbl pointer as NULL. If the BROPT_NEIGH_SUPPRESS_ENABLED option is active, the bridge attempts to process ICMPv6 Neighbor Discovery packets by calling neigh_lookup() with the uninitialized table pointer. This results in a kernel oops and immediate system crash. The fix involves replacing static IS_ENABLED(CONFIG_IPV6) checks with runtime ipv6_mod_enabled() checks to ensure suppression logic is bypassed when IPv6 is disabled.

Affected products

  • Linux Linux Kernel All versions prior to the March 2026 patches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-04: other: Patch authored by Fernando Fernandez Mancera
  • 2026-03-25: advisory: Initial disclosure and NVD publication
  • 2026-07-14: other: Siemens updated advisory with affected industrial products

References

Related threats