CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fib6: fix NULL deref in fib6walkcontinue() on multi-batch dump
inet6dumpfib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6newtable() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6dumptable() to set w->root to the wrong table while w->node still points into the previous one. fib6walkcontinue() dereferences w->node->parent (NULL) and panics:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6walkcontinue+0x6e/0x170 Call Trace: <TASK> fib6dumptable.isra.0+0xc5/0x240 inet6dumpfib+0xf6/0x420 rtnldumpit+0x30/0xa0 netlinkdump+0x15b/0x460 netlinkrecvmsg+0x1d6/0x2a0 sysrecvmsg+0x17a/0x190
Fix by storing tb->tb6id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel so that inet6_dump_fib()/fib6_dump_table() save and resume progress by storing tb->tb6_id in cb->args[1], and fib6_walk_continue() resumes by skipping entries until the id matches the saved one. This prevents w->node->parent NULL dereference and panics during multi-batch dump/resume.
Linux kernel Implement fix to fib6_walk_continue() multi-batch dump logic = Store tb->tb6_id in cb->args[1] (progress) instead of positional index; on resume skip entries until the id matches; ensure walker state aligns to the correct table