Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. By incorrectly handling the transition between different internet protocol versions (IPv4 and IPv6) in network routing tables, the system may attempt to access invalid memory. This results in a kernel panic, leading to a complete system outage and denial of service.
Technical details
A vulnerability exists in the Linux kernel's nexthop management (net/ipv4/nexthop.c) due to improper state updates during nexthop replacement. When an IPv6 nexthop is replaced with an IPv4 nexthop, the 'has_v4' flag for associated nexthop groups is not updated because nh_group_v4_update was only triggered for AF_INET to AF_INET6 transitions. This stale flag allows IPv6 routes to be incorrectly attached to groups containing only IPv4 members. Subsequent route lookups call nexthop_fib6_nh(), which returns NULL for AF_INET members in an IPv6 context, resulting in a NULL pointer dereference and kernel panic. The issue is resolved by ensuring the family update logic triggers on any address family change.
Affected products
- Linux Linux Kernel 7bf4796dd099 to ceffe81a0be92afc0cd1340bc8ca46559cce9bb4
Timeline
- 2026-04-13: patched: Initial fix authored by Jiayuan Chen
- 2026-06-24: disclosed: CVE-2026-53012 published
References
- https://git.kernel.org/stable/c/29c95185ba32b621fbc3800fb86e7dc3edf5c2be
- https://git.kernel.org/stable/c/613c8f4a501421dd258b07ea614205d4e16ec845
- https://git.kernel.org/stable/c/6275796f22bb382f3e9aa58ed0b4ef7bdad78cb8
- https://git.kernel.org/stable/c/9c2d6770a5f4545a307eb66979bef7656a34d621
- https://git.kernel.org/stable/c/aaac3bed034239e1d75732211d9b05f30b0b4f35
- https://git.kernel.org/stable/c/ad85961004fd4bd2f31209ac4b07612c6cefb9e7
- https://git.kernel.org/stable/c/b3b7e850e1541f0520c4a12ec884255c30427ff6