CVE-2026-97601: ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: 6lowpan: fix NULL dereference in lowpannewlink
TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink() checks only the device type before dereferencing the pointer, so an RTMNEWLINK request can trigger a NULL pointer dereference.
Reject devices without ieee802154ptr along with devices of the wrong type.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
An attacker must be able to use TUNSETLINK to change a TUN device's link-layer type to ARPHRD_IEEE802154 and then issue an RTM_NEWLINK request that reaches lowpan_newlink(). The affected device lacks an initialized ieee802154_ptr, which is dereferenced by the vulnerable code.
What is the impact of successful exploitation?
The described result is a NULL pointer dereference in the Linux kernel. This can trigger a kernel crash or denial of service.
How does the fix prevent the issue?
The fix makes lowpan_newlink() reject devices that do not have ieee802154_ptr initialized, in addition to rejecting devices with an incorrect link-layer type.