CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix null-ptr-deref in fib6nhmtuchange().
fib6nhmtuchange() re-fetches idev via in6devget(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconfifdown() clears dev->ip6ptr with RCUINITPOINTER() after rt6disableip() has released tb6lock, so the RA-driven MTU walk can observe a NULL idev and oops. The caller rt6mtuchangeroute() guards its own in6devget(), but this re-fetch is unguarded; nexthop-backed routes survive addrconfifdown()'s flush, so the walk still reaches it after ip6ptr is nulled.
Return 0 when idev is NULL, matching rt6mtuchangeroute() and the fib6mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in fib6mtu().").
Oops: general protection fault, ... KASAN: null-ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6nhmtuchange+0x203/0x990 rt6mtuchangeroute+0x141/0x1d0 fib6cleanall+0xd0/0x160 rt6mtuchange+0xb4/0x100 ndiscrouterdiscovery+0x24b5/0x2cb0 icmpv6rcv+0x12e9/0x1710 ipv6rcv+0x39b/0x410
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5ad509c1fdad
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64538?
The severity of CVE-2026-64538 is rated at risk level 37.
How do I fix CVE-2026-64538?
To fix CVE-2026-64538, update to the latest version of the Linux Kernel that addresses this vulnerability.
What specific issue does CVE-2026-64538 address?
CVE-2026-64538 addresses a null pointer dereference issue in the fib6_nh_mtu_change function of the Linux Kernel.
Which versions of the Linux Kernel are affected by CVE-2026-64538?
CVE-2026-64538 affects certain versions of the Linux Kernel prior to the fix being implemented.
What are the potential impacts of CVE-2026-64538?
The impact of CVE-2026-64538 can lead to system crashes or instability due to null pointer dereferencing.