CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths
In the Linux kernel, the following vulnerability has been resolved:
ipv6: add NULL checks for idev in SRv6 paths
in6devget() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6MINMTU or after NETDEVUNREGISTER).
Add NULL checks for idev returned by in6devget() in both seg6hmacvalidateskb() and ipv6srhrcv() to prevent potential NULL pointer dereferences.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can the vulnerable code be reached?
Systems are exposed when they process SRv6 traffic on a device that has no IPv6 configuration, such as when its MTU is below IPV6_MIN_MTU or after the device has been unregistered. The affected paths are seg6_hmac_validate_skb() and ipv6_srh_rcv().
What level of access does an attacker need, and what is the expected impact?
An attacker needs local access and low privileges; no user interaction is required. Successful exploitation can cause a NULL pointer dereference with high availability impact, as reflected by the CVSS vector's AV:L, PR:L, UI:N, and A:H values.
Are default configurations known to be affected?
The available data identifies devices without IPv6 configuration as the relevant condition, but does not state whether typical default Linux kernel configurations meet that condition.