CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix ndtbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the ndtbl is never initialized because inet6init() exits before ndiscinit() is called which initializes it. Then, if neighsuppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, brdosuppressnd() will dereference ipv6stub->ndtbl which is NULL, passing it to neighlookup(). This causes a kernel NULL pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000268 Oops: 0000 [#1] PREEMPT SMP NOPTI [...] RIP: 0010:neighlookup+0x16/0xe0 [...] Call Trace: <IRQ> ? neighlookup+0x16/0xe0 brdosuppressnd+0x160/0x290 [bridge] brhandleframefinish+0x500/0x620 [bridge] brhandleframe+0x353/0x440 [bridge] netifreceiveskbcore.constprop.0+0x298/0x1110 netifreceiveskbonecore+0x3d/0xa0 processbacklog+0xa0/0x140 napipoll+0x2c/0x170 netrxaction+0x2c4/0x3a0 handlesoftirqs+0xd0/0x270 dosoftirq+0x3f/0x60
Fix this by replacing ISENABLED(IPV6) call with ipv6modenabled() in the callers. This is in essence disabling NS/NA suppression when IPv6 is disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23381?
The severity of CVE-2026-23381 is rated as medium due to the potential for a NULL pointer dereference leading to a system crash.
How do I fix CVE-2026-23381?
To fix CVE-2026-23381, update your Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2026-23381?
CVE-2026-23381 affects the Linux kernel when booting with the 'ipv6.disable=1' parameter.
Is CVE-2026-23381 exploitative in nature?
CVE-2026-23381 is not directly exploitative but can lead to denial of service if the NULL dereference is triggered.
What are the potential consequences of CVE-2026-23381?
The potential consequences of CVE-2026-23381 include service interruption and system instability due to crashes.