CVE-2026-23304 - Vulnerability Details

- ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

l3mdev_master_dev_rcu() can return NULL when the slave device is being
un-slaved from a VRF. All other callers deal with this, but we lost
the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
device with address").

KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
Call Trace:
ip6_pol_route (net/ipv6/route.c:2318)
fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
ip6_route_output_flags (net/ipv6/route.c:2607)
vrf_process_v6_outbound (drivers/net/vrf.c:437)

I was tempted to rework the un-slaving code to clear the flag first
and insert synchronize_rcu() before we remove the upper. But looks like
the explicit fallback to loopback_dev is an established pattern.
And I guess avoiding the synchronize_rcu() is nice, too.

Published: 2026-03-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a NULL pointer dereference in the Linux kernel's IPv6 routing code, triggered when a device is un-slaved from a Virtual Routing and Forwarding (VRF) instance. The bug causes the kernel to dereference a NULL pointer during route allocation, leading to a kernel panic and a system reboot. The weakness corresponds to CWE‑476 and results in a denial of service by crashing the operating system.

Affected Systems

Any Linux system running a kernel version that includes the affected IPv6 routing code, regardless of distribution, is potentially vulnerable. The issue is tied to devices that use VRF functionality for IPv6 routing. No specific vendor or version is listed, so all kernels preceding the patch incorporating commit 4832c30d5458 are affected.

Risk and Exploitability

The CVSS score for this issue is 5.5, indicating moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require triggering the VRF un‑slaving process, which is usually a local or privileged operation; thus the attack vector is likely local or requires elevated privileges. Overall, the risk is moderate but the probability of real‑world exploitation is low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< d542e2ac7f9e288d49735be0775611547ca4e0ee
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< a73fe9f4ae84a239d5b2686f47a58c158aee2eb4
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 4a48fe59f29f673a3d042d679f26629a9c3e29d4
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 581800298313c9fd75e94985e6d37d21b7e35d34
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 3310fc11fc47387d1dd4759b0bc961643ea11c7f
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 0b5a7826020706057cc5a9d9009e667027f221ee
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< ae88c8256547b63980770a9ea7be73a15900d27e
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,4a48fe59f29f673a3d042d679f26629a9c3e29d4)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,581800298313c9fd75e94985e6d37d21b7e35d34)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,3310fc11fc47387d1dd4759b0bc961643ea11c7f)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,0b5a7826020706057cc5a9d9009e667027f221ee)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,ae88c8256547b63980770a9ea7be73a15900d27e)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	generic	—
`[0,4.14)`	unaffected	generic	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fix (commit 4832c30d5458).
Reboot the system to ensure the patched kernel is running.
If an immediate kernel upgrade is not possible, consider disabling VRF or preventing un‑slave operations as a temporary containment.

Generated by OpenCVE AI on March 26, 2026 at 02:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee
https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a
https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f
https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4
https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34
https://git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4
https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e
https://git.kernel.org/stable/c/d542e2ac7f9e288d49735be0775611547ca4e0ee
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23304-485b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23304
https://www.cve.org/CVERecord?id=CVE-2026-23304

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4 https://git.kernel.org/stable/c/d542e2ac7f9e288d49735be0775611547ca4e0ee

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23304-485b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23304 https://www.cve.org/CVERecord?id=CVE-2026-23304
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.
Title		ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4 https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34 https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:26:59.015Z

Updated: 2026-04-18T08:57:51.949Z

Reserved: 2026-01-13T15:37:45.993Z

Link: CVE-2026-23304

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-25T11:16:26.180

Modified: 2026-04-18T09:16:18.170

Link: CVE-2026-23304

Redhat

Severity : Moderate

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23304 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-26T12:16:52Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object