CVE-2026-23304
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.
How to fix
- linux linux_kernel5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7 or later
- git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee
- git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a
- git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f
- git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4
- git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34
- git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4
- git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e
- git.kernel.org/stable/c/d542e2ac7f9e288d49735be0775611547ca4e0ee
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.14 ≤ v < 5.10.253, 5.11 ≤ v < 5.15.203, 5.16 ≤ v < 6.1.167, 6.2 ≤ v < 6.6.130, 6.7 ≤ v < 6.12.77, 6.13 ≤ v < 6.18.17, 6.19 ≤ v < 6.19.7, 7.0 | 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.