Executive brief
The Linux kernel's IPv6 networking code can crash if a physical network device is unregistered while being accessed by the stats retrieval function. This is a stability issue that can cause kernel panics and service interruption on systems using IPv6 networking, particularly those using Virtual Routing and Forwarding (VRF) features.
Technical details
A NULL pointer dereference vulnerability exists in the __in6_dev_stats_get() function within the IPv6 address configuration code. The function calls dev_get_by_index_rcu() to retrieve a network device, but does not check if the returned pointer is NULL before dereferencing it. This occurs when a physical device is unregistered during the lookup. The vulnerability is triggered in the IPv6 stats collection path, particularly affecting VRF (Virtual Routing and Forwarding) implementations. The fix adds a NULL pointer check after dev_get_by_index_rcu() returns, returning early if no valid device is found. This is a local, kernel-space issue requiring no network access or authentication.
Affected products
- Linux Linux kernel Multiple versions (fixes commit e1ae5c2ea478)
Timeline
- 2026-08-28: disclosed
- 2026-05-26: patched: Upstream commit 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc by Eric Dumazet