Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could allow an attacker to crash the system. By sending specific network traffic, an unprivileged user can trigger a system failure (kernel oops) due to how the system handles certain IPv6 messages. This primarily impacts the availability of the affected server or device.
Technical details
A race condition exists in the IPv6 Neighbor Discovery (ndisc) component of the Linux kernel. Specifically, the function accept_untracked_na() re-fetches the inet6_dev pointer without a NULL check. If a concurrent event, such as lowering the MTU below the minimum required for IPv6, triggers addrconf_ifdown(), the pointer can be cleared between the initial check and the subsequent dereference. This results in a NULL pointer dereference and a kernel oops. The vulnerability is reachable by unprivileged users via network namespaces. The fix involves passing the already validated idev pointer from the caller to ensure it remains valid throughout the RCU critical section.
Affected products
- Linux Linux Kernel 6.0 to 6.12.97, 6.18.40, 7.1.5
Timeline
- 2026-06-17: disclosed: Initial patch submitted by Weiming Shi
- 2026-07-24: patched: Commits merged into stable branches
- 2026-07-27: advisory: CVE-2026-64542 published