Junglewise Threat Intelligence

CVE-2026-23439: Linux Kernel NULL pointer dereference in udp_tunnel

CVE-2026-23439 · Severity: medium · CVSS 5.5 · Published 2026-04-03

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking component when IPv6 support is disabled in the system configuration. This flaw can cause the system to crash (Blue Screen/Kernel Panic) when a privileged user attempts to create certain types of network tunnels. While it does not allow for data theft, it can lead to a complete service outage or system instability on affected devices, including certain industrial controllers.

Technical details

A NULL pointer dereference exists in the Linux kernel's udp_tunnel component. When the kernel is compiled with CONFIG_IPV6=n, the function udp_sock_create6() incorrectly returns 0 (success) without initializing the socket pointer. Subsequent calls, such as from fou_create(), proceed to dereference this uninitialized pointer, leading to a kernel panic. The attack vector is local and requires privileged access to trigger the vulnerable code path via netlink messages. The fix involves updating udp_sock_create6() to return -EPFNOSUPPORT when IPv6 is disabled, ensuring callers follow proper error-handling paths.

Affected products

  • Linux Linux Kernel All versions prior to the fix where CONFIG_IPV6 is disabled
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-16: other: Patch authored
  • 2026-03-25: patched: Commits merged into stable trees
  • 2026-04-03: disclosed: CVE published

References

Related threats