CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: add NULL check for idev in ipv6hopioam()
Reported by Sashiko:
The function ipv6hopioam() accesses in6devget(skb->dev)->cnf.ioam6enabled without validating the returned idev pointer. Because addrconfifdown() can concurrently clear dev->ip6ptr via RCU, in6devget() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option.
Let's add a check and use SKBDROPREASONIPV6DISABLED accordingly.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64116?
CVE-2026-64116 has a high severity rating of 7.5.
What type of vulnerability is CVE-2026-64116?
CVE-2026-64116 is classified as a null pointer dereference vulnerability.
How does CVE-2026-64116 affect the Linux kernel?
CVE-2026-64116 allows access to the idev pointer in the ipv6_hop_ioam() function without proper validation, potentially leading to exploits.
How do I fix CVE-2026-64116?
To fix CVE-2026-64116, ensure that your Linux kernel is updated to the latest version where the NULL check for idev has been added.
Who reported CVE-2026-64116?
CVE-2026-64116 was reported by a user named Sashiko.