Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could allow a local user to crash the system. The issue occurs when the system processes specific Segment Routing (SRv6) network traffic on devices that have lost their IPv6 configuration. This results in a system 'kernel panic' or crash, leading to a denial of service for all users and applications on the affected machine.
Technical details
A NULL pointer dereference exists in the Linux kernel's IPv6 stack within the Segment Routing (SRv6) paths. The function __in6_dev_get() can return NULL if a network device lacks an IPv6 configuration (e.g., due to an MTU below the minimum required for IPv6 or after a NETDEV_UNREGISTER event). The functions seg6_hmac_validate_skb() and ipv6_srh_rcv() failed to validate this return value before use. A local attacker can exploit this to trigger a kernel oops/panic, resulting in a denial of service. Patches have been released across multiple stable kernel branches to add the necessary NULL checks.
Affected products
- Linux Linux Kernel 4.10.1 to 6.12.83, 6.13 to 6.19.10
Timeline
- 2026-03-18: patched: Initial patch committed to mainline kernel.
- 2026-04-03: disclosed: CVE published.
- 2026-04-03: advisory
References
- https://git.kernel.org/stable/c/0348fa0ada37cef7c6b5ab2a428bb2c6aee784e4
- https://git.kernel.org/stable/c/06413793526251870e20402c39930804f14d59c0
- https://git.kernel.org/stable/c/50352fc103928e10e8729abc79a0d05abef26c4d
- https://git.kernel.org/stable/c/83d705d35e583cb1b1eacf196dfe7b77d442018e
- https://git.kernel.org/stable/c/a25853c9feea7bbf31d157ff6e004d2d3b4f7f13
- https://git.kernel.org/stable/c/bc9843c39f9932a8b36efd1d362ea00bb88e4e78
- https://git.kernel.org/stable/c/c5cedee5d97382176573bbe21e1724e737a5eb64