CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved:
net: vxlan: fix ndtbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the ndtbl is never initialized because inet6init() exits before ndiscinit() is called which initializes it. If an IPv6 packet is injected into the interface, routeshortcircuit() is called and a NULL pointer dereference happens on neighlookup().
BUG: kernel NULL pointer dereference, address: 0000000000000380 Oops: Oops: 0000 [#1] SMP NOPTI [...] RIP: 0010:neighlookup+0x20/0x270 [...] Call Trace: <TASK> vxlanxmit+0x638/0x1ef0 [vxlan] devhardstartxmit+0x9e/0x2e0 devqueuexmit+0xbee/0x14e0 packetsendmsg+0x116f/0x1930 syssendto+0x1f5/0x200 x64syssendto+0x24/0x30 dosyscall64+0x12f/0x1590 entrySYSCALL64afterhwframe+0x76/0x7e
Fix this by adding an early check on routeshortcircuit() when protocol is ETHPIPV6. Note that ipv6modenabled() cannot be used here because VXLAN can be built-in even when IPv6 is built as a module.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23293?
CVE-2026-23293 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2026-23293?
To fix CVE-2026-23293, update your Linux kernel to the latest patched version where this vulnerability has been resolved.
What systems are affected by CVE-2026-23293?
CVE-2026-23293 affects any system running Linux kernel versions that do not include the fix for this vulnerability.
Can CVE-2026-23293 lead to denial of service?
Yes, CVE-2026-23293 can potentially lead to a denial of service due to a NULL dereference when IPv6 is disabled.
Is CVE-2026-23293 related to IPv6 functionality?
Yes, CVE-2026-23293 specifically involves a NULL dereference in the vxlan implementation when IPv6 is disabled.