CVE-2026-68336
Description
In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconf_all NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route(). BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by adding ipv6_mod_enabled() condition check in the caller.
How to fix
- Linux Linux451c2d5422a309393aa8ae161fc1a527c2f19ab2, 2a4bad24ac5296b262ad821aa5e08bb265e6b154, 690ce66782778e8c4b1fdd79c0b0890a100e9522, 992dce02bdabbd9883255ea9b36494e34a7821d7, 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038, 1c975de3343cdef506f2eecc833cc1f14b0401c4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 ≤ v < 451c2d5422a309393aa8ae161fc1a527c2f19ab2, 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 ≤ v < 2a4bad24ac5296b262ad821aa5e08bb265e6b154, 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 ≤ v < 690ce66782778e8c4b1fdd79c0b0890a100e9522, 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 ≤ v < 992dce02bdabbd9883255ea9b36494e34a7821d7, 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 ≤ v < 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038, 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 ≤ v < 1c975de3343cdef506f2eecc833cc1f14b0401c4, 5.18 | 451c2d5422a309393aa8ae161fc1a527c2f19ab2, 2a4bad24ac5296b262ad821aa5e08bb265e6b154, 690ce66782778e8c4b1fdd79c0b0890a100e9522, 992dce02bdabbd9883255ea9b36494e34a7821d7, 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038, 1c975de3343cdef506f2eecc833cc1f14b0401c4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.