UBUNTU-CVE-2026-89561: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6rplsrhrcv() ipv6rplsrhrcv() dereferences idev from in6devget() without a NULL check when reading idev->cnf.rplsegenabled. When the device's MTU drops below IPV6MINMTU, addrconfifdown() clears dev->ip6ptr through RCUINITPOINTER(). A packet that passed the idev check in ip6rcvcore() can then reach ipv6rplsrhrcv() with dev->ip6ptr already NULL. Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200: BUG: KASAN: null-ptr-deref in ipv6rplsrhrcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394 CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: <IRQ> kasanreport+0xc6/0x100 ipv6rplsrhrcv+0xb3/0x1070 ip6protocoldeliverrcu+0x759/0x9a0 ip6inputfinish+0xa8/0x1b0 ip6input+0xe1/0x490 ipv6rcv+0x33d/0x460 netifreceiveskbonecore+0xd6/0x130 processbacklog+0x2cc/0xa00 napipoll.constprop.0+0x56/0x270 netrxaction+0x327/0x730 handlesoftirqs+0x11e/0x630 dosoftirq+0xb3/0xf0 </IRQ> Both ipv6rplsrhrcv() and ipv6srhrcv() are called only from ipv6rthdrrcv(), which already has an idev lookup. Fix the NULL dereference on the RPL path by checking idev in ipv6rthdrrcv(), before it calls either function. The callees take idev as an argument and no longer call in6devget(), so the packet is now dropped in one place, with SKBDROPREASONIPV6DISABLED on both paths.