CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled
bonding: fix devconfall NULL dereference when IPv6 is disabled
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
If you boot with 'ipv6.disable=1', ensure the caller of ip6_pol_route() includes an ipv6_mod_enabled() condition check before dereferencing net->ipv6.devconf_all (fix for kernel NULL pointer dereference at ip6_pol_route()).
Linux kernel ipv6.disable = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68336?
CVE-2026-68336 has a risk score of 22, indicating a significant impact due to a NULL pointer dereference.
How do I fix CVE-2026-68336?
To fix CVE-2026-68336, ensure that you are using an updated version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-68336?
CVE-2026-68336 affects systems running affected versions of the Linux kernel with the IPv6 disabled parameter.
What type of vulnerability is CVE-2026-68336?
CVE-2026-68336 is categorized as a Null Pointer Dereference vulnerability.
What happens if CVE-2026-68336 is exploited?
Exploitation of CVE-2026-68336 can lead to system instability or crashes when IPv6 is disabled.