CVE-2026-23304

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address").

KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437)

I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before d542e2ac7f9e288d49735be0775611547ca4e0eeAffected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before a73fe9f4ae84a239d5b2686f47a58c158aee2eb4Affected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 4a48fe59f29f673a3d042d679f26629a9c3e29d4Affected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 581800298313c9fd75e94985e6d37d21b7e35d34Affected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 3310fc11fc47387d1dd4759b0bc961643ea11c7fAffected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 0b5a7826020706057cc5a9d9009e667027f221eeAffected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before ae88c8256547b63980770a9ea7be73a15900d27eAffected 4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5aAffected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before d542e2ac7f9e288d49735be0775611547ca4e0eeAffected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before a73fe9f4ae84a239d5b2686f47a58c158aee2eb4Affected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 4a48fe59f29f673a3d042d679f26629a9c3e29d4Affected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 581800298313c9fd75e94985e6d37d21b7e35d34Affected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 3310fc11fc47387d1dd4759b0bc961643ea11c7fAffected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 0b5a7826020706057cc5a9d9009e667027f221eeAffected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before ae88c8256547b63980770a9ea7be73a15900d27eAffected
4832c30d5458387ff2533ff66fbde26ad8bb5a2d to before 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5aAffected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.