Junglewise Threat Intelligence

CVE-2026-64116: Linux Kernel NULL pointer dereference in ipv6_hop_ioam

CVE-2026-64116 · Severity: info · CVSS 5.3 · Published 2026-07-19

Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's IPv6 networking component, specifically within the In-situ Operations, Administration, and Maintenance (IOAM) feature. Under specific conditions during network interface shutdown, the system may attempt to access memory that is no longer available. This can lead to a system crash or kernel panic, resulting in a denial of service.

Technical details

A race condition exists in the 'ipv6_hop_ioam()' function within 'net/ipv6/exthdrs.c'. The function accesses the 'idev' pointer (retrieved via '__in6_dev_get') without validating it. Because 'addrconf_ifdown()' can concurrently clear 'dev->ip6_ptr' via RCU during interface teardown, the pointer can be NULL when processing an IOAM Hop-by-Hop option. An attacker sending specially crafted IPv6 packets during these timing windows could trigger a NULL pointer dereference. The fix introduces a NULL check for 'idev' and ensures packets are dropped with 'SKB_DROP_REASON_IPV6DISABLED' if the configuration is missing.

Affected products

  • Linux Linux 5.15 to 5.15.210, 6.1 to 6.1.176, 6.6 to 6.6.143, 6.12 to 6.12.92, 6.18 to 6.18.34

Timeline

  • 2026-05-17: other: Initial patch submitted by Justin Iurman
  • 2026-07-19: advisory: CVE-2026-64116 published

References