Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux Kernel IPv6: Unstable Network Connection
published 7 months ago
Summary
A bug in the Linux kernel's IPv6 feature can cause a network connection to become unstable. This affects Linux systems using IPv6, which could lead to dropped connections. To fix this, update your Linux kernel to the latest version.
What to do
- Update linux kernel to version 6.19.7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Linux | linux | kernel |
>= 6.19.0, < 6.19.7 Fix: upgrade to 6.19.7
|
Original advisory text
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
l3mdev_master_dev_rcu() can return NULL when the slave device is being
un-slaved from a VRF. All other callers deal with this, but we lost
the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
device with address").
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
Call Trace:
ip6_pol_route (net/ipv6/route.c:2318)
fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
ip6_route_output_flags (net/ipv6/route.c:2607)
vrf_process_v6_outbound (drivers/net/vrf.c:437)
I was tempted to rework the un-slaving code to clear the flag first
and insert synchronize_rcu() before we remove the upper. But looks like
the explicit fallback to loopback_dev is an established pattern.
And I guess avoiding the synchronize_rcu() is nice, too.
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
l3mdev_master_dev_rcu() can return NULL when the slave device is being
un-slaved from a VRF. All other callers deal with this, but we lost
the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
device with address").
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
Call Trace:
ip6_pol_route (net/ipv6/route.c:2318)
fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
ip6_route_output_flags (net/ipv6/route.c:2607)
vrf_process_v6_outbound (drivers/net/vrf.c:437)
I was tempted to rework the un-slaving code to clear the flag first
and insert synchronize_rcu() before we remove the upper. But looks like
the explicit fallback to loopback_dev is an established pattern.
And I guess avoiding the synchronize_rcu() is nice, too.
References
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee URL
- https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a URL
- https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f URL
- https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4 URL
- https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34 URL
- https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23304... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-23304 Vendor Advisory
Timeline
Published25 Mar 2026
Updated18 Apr 2026
First seen18 Apr 2026
Track software like this
Free during beta