Executive brief
A vulnerability was identified in the Linux kernel's IPv6 networking component. The issue occurs when the system attempts to clean up network routes, potentially leading to a system crash (kernel panic). This could allow a local user to disrupt the availability of the server or device, causing a denial-of-service condition.
Technical details
A null pointer dereference (NPD) exists in the cleanup_prefix_route() function within net/ipv6/addrconf.c. The vulnerability is triggered because addrconf_get_prefix_route() can return a sentinel entry (fib6_null_entry) that contains a NULL fib6_table pointer. When the kernel attempts to access this pointer to set a route's expiration time or acquire a spinlock, it triggers a general protection fault. An attacker with local access could potentially trigger this condition by manipulating IPv6 address deletions via netlink (RTM_DELADDR). The issue has been resolved by adding a check to ensure the entry is not the null sentinel before accessing its table pointer.
Affected products
- Linux Linux Kernel 5.10 to 6.14
Timeline
- 2026-06-09: disclosed: Initial patch submitted by Ido Schimmel
- 2026-06-19: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-06-25: advisory: CVE-2026-53214 published
References
- https://git.kernel.org/stable/c/07d9a0870a178843cea44cfd58c27445dc94cf5f
- https://git.kernel.org/stable/c/192df376a05c2db15564640f9da7e20907c1fa24
- https://git.kernel.org/stable/c/5f82b02b4059ddc06e4fcfd057bfb59fd6885cd2
- https://git.kernel.org/stable/c/653a2849305708f75260b5296f17b2a759ff9cc7
- https://git.kernel.org/stable/c/b70c687b7cf267fb08586667a3946c8851cad672