CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix NULL pointer deref in ip6rtgetdevrcu()
l3mdevmasterdevrcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6rtpcpualloc() -> ip6rtgetdevrcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address").
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6rtpcpualloc (net/ipv6/route.c:1418) Call Trace: ip6polroute (net/ipv6/route.c:2318) fib6rulelookup (net/ipv6/fib6rules.c:115) ip6routeoutputflags (net/ipv6/route.c:2607) vrfprocessv6outbound (drivers/net/vrf.c:437)
I was tempted to rework the un-slaving code to clear the flag first and insert synchronizercu() before we remove the upper. But looks like the explicit fallback to loopbackdev is an established pattern. And I guess avoiding the synchronizercu() is nice, too.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Update ip6_rt_get_dev_rcu() to explicitly fall back to loopback_dev when l3mdev_master_dev_rcu() returns NULL during VRF slave un-slaving.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23304?
CVE-2026-23304 has been rated as a high severity vulnerability due to potential exploitation leading to a null pointer dereference.
How do I fix CVE-2026-23304?
To fix CVE-2026-23304, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What software is affected by CVE-2026-23304?
CVE-2026-23304 affects the Linux kernel, particularly versions prior to the implementation of the fix.
What is the impact of CVE-2026-23304?
The impact of CVE-2026-23304 includes potential denial of service due to null pointer dereference when handling IPv6 routes.
When was CVE-2026-23304 published?
CVE-2026-23304 was published on a specific date which has been documented in official security bulletins.