Executive brief
A vulnerability in the Linux kernel's networking component could allow a remote attacker to crash the system. The issue occurs when the system receives specific network diagnostic messages (ICMP PROBE) while the IPv6 networking module is present but not actively running. This can lead to a kernel crash, resulting in a denial of service for the affected server or device.
Technical details
A NULL pointer dereference vulnerability exists in net/ipv4/icmp.c within the icmp_build_probe() function. The root cause is improper handling of the return value from ipv6_stub->ipv6_dev_find(). When the IPv6 stack is compiled as a module but not loaded (CONFIG_IPV6=m), the function returns ERR_PTR(-EAFNOSUPPORT). Subsequent processing passes this error pointer to dev_hold(), triggering a kernel panic. An unauthenticated remote attacker can trigger this by sending a specially crafted ICMP PROBE message containing an IPv6 interface identifier to a system where IPv6 is inactive. The vulnerability has been patched in multiple stable kernel branches by adding a check for IS_ERR(dev) to silently discard such requests.
Affected products
- Linux Linux Kernel 5.13 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-05-06: advisory: Initial disclosure and CVE assignment
- 2026-05-06: patched: Patches released across multiple stable kernel versions
References
- https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673
- https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d
- https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5
- https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48
- https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d
- https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964
- https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8