CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix devconfall NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init() exits before addrconfinit() is called which initializes it. bondsendvalidate(), however, will still call bondnssendall() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconfall in ip6polroute().
BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bondarpmonitor [bonding] RIP: 0010:ip6polroute+0x69/0x480 [...] Call Trace: <TASK> ? srsoreturnthunk+0x5/0x5f ? pfxip6polrouteoutput+0x10/0x10 fib6rulelookup+0xfe/0x260 ? wakeuppreempt+0x8a/0x90 ? srsoreturnthunk+0x5/0x5f ? srsoreturnthunk+0x5/0x5f ? schedbalancerq+0x369/0x810 ip6routeoutputflags+0xd7/0x170 bondnssendall+0xde/0x280 [bonding] bondabarpprobe+0x296/0x320 [bonding] ? srsoreturnthunk+0x5/0x5f bondactivebackuparpmon+0xb4/0x2c0 [bonding] processonework+0x196/0x370 workerthread+0x1af/0x320 ? srsoreturnthunk+0x5/0x5f ? pfxworkerthread+0x10/0x10 kthread+0xe3/0x120 ? pfxkthread+0x10/0x10 retfromfork+0x199/0x260 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
Fix this by adding ipv6modenabled() condition check in the caller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If you boot with 'ipv6.disable=1', ensure the caller of ip6_pol_route() includes an ipv6_mod_enabled() condition check before dereferencing net->ipv6.devconf_all (fix for kernel NULL pointer dereference at ip6_pol_route()).
Linux kernel ipv6.disable = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68336?
CVE-2026-68336 has a risk score of 22, indicating a significant impact due to a NULL pointer dereference.
How do I fix CVE-2026-68336?
To fix CVE-2026-68336, ensure that you are using an updated version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-68336?
CVE-2026-68336 affects systems running affected versions of the Linux kernel with the IPv6 disabled parameter.
What type of vulnerability is CVE-2026-68336?
CVE-2026-68336 is categorized as a Null Pointer Dereference vulnerability.
What happens if CVE-2026-68336 is exploited?
Exploitation of CVE-2026-68336 can lead to system instability or crashes when IPv6 is disabled.