CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: guard against possible NULL deref in in6devstatsget()
devgetbyindexrcu() could return NULL if the original physical device is unregistered.
Found by Sashiko.
Affected Software
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
The NULL dereference is possible when __in6_dev_stats_get() looks up the original physical device and dev_get_by_index_rcu() returns NULL because that device has been unregistered.
What is the likely impact of successful triggering?
The described failure is a NULL pointer dereference in the Linux kernel. The provided information does not specify additional impact beyond that condition.
How can I determine whether systems have the fix?
Check whether the kernel source or applied stable patches include one of the referenced commits: a23f2c68c6635e41404f189f8f7ae910738cebdb, e14db43677946bf2095febd294bb3c13ab375ab7, or 1a4adfbeb47a212a64539137411f1ca168474d33.