CVE-2026-23381

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. Then, if neigh_suppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will dereference ipv6_stub->nd_tbl which is NULL, passing it to neigh_lookup(). This causes a kernel NULL pointer dereference.

BUG: kernel NULL pointer dereference, address: 0000000000000268 Oops: 0000 [#1] PREEMPT SMP NOPTI [...] RIP: 0010:neigh_lookup+0x16/0xe0 [...] Call Trace: <IRQ> ? neigh_lookup+0x16/0xe0 br_do_suppress_nd+0x160/0x290 [bridge] br_handle_frame_finish+0x500/0x620 [bridge] br_handle_frame+0x353/0x440 [bridge] __netif_receive_skb_core.constprop.0+0x298/0x1110 __netif_receive_skb_one_core+0x3d/0xa0 process_backlog+0xa0/0x140 __napi_poll+0x2c/0x170 net_rx_action+0x2c4/0x3a0 handle_softirqs+0xd0/0x270 do_softirq+0x3f/0x60

Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in the callers. This is in essence disabling NS/NA suppression when IPv6 is disabled.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ed842faeb2bd49256f00485402f3113205f91d30 to before a9d712ccfeef737c0e700a4b5b98f310e07b6b60Affected ed842faeb2bd49256f00485402f3113205f91d30 to before a5c56e65b685360dd3f2278aeff8c21061feb665Affected ed842faeb2bd49256f00485402f3113205f91d30 to before 7a894eb5de246d79f13105c55a67381039a24d44Affected ed842faeb2bd49256f00485402f3113205f91d30 to before a12cdaa3375f0bd3c8f4e564be7c143529abfe5bAffected ed842faeb2bd49256f00485402f3113205f91d30 to before aa73deb3b6b730ec280d45b3f423bfa9e17bc122Affected ed842faeb2bd49256f00485402f3113205f91d30 to before 33dec6f10777d5a8f71c0a200f690da5ae3c2e55Affected ed842faeb2bd49256f00485402f3113205f91d30 to before 20ef5c25422f97dd09d751e5ae6c18406cdc78e6Affected ed842faeb2bd49256f00485402f3113205f91d30 to before e5e890630533bdc15b26a34bb8e7ef539bdf1322Affected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

ed842faeb2bd49256f00485402f3113205f91d30 to before a9d712ccfeef737c0e700a4b5b98f310e07b6b60Affected
ed842faeb2bd49256f00485402f3113205f91d30 to before a5c56e65b685360dd3f2278aeff8c21061feb665Affected
ed842faeb2bd49256f00485402f3113205f91d30 to before 7a894eb5de246d79f13105c55a67381039a24d44Affected
ed842faeb2bd49256f00485402f3113205f91d30 to before a12cdaa3375f0bd3c8f4e564be7c143529abfe5bAffected
ed842faeb2bd49256f00485402f3113205f91d30 to before aa73deb3b6b730ec280d45b3f423bfa9e17bc122Affected
ed842faeb2bd49256f00485402f3113205f91d30 to before 33dec6f10777d5a8f71c0a200f690da5ae3c2e55Affected
ed842faeb2bd49256f00485402f3113205f91d30 to before 20ef5c25422f97dd09d751e5ae6c18406cdc78e6Affected
ed842faeb2bd49256f00485402f3113205f91d30 to before e5e890630533bdc15b26a34bb8e7ef539bdf1322Affected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.