CVE-2026-23304

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

Published Mar 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

l3mdev_master_dev_rcu() can return NULL when the slave device is being
un-slaved from a VRF. All other callers deal with this, but we lost
the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
device with address").

KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
Call Trace:
ip6_pol_route (net/ipv6/route.c:2318)
fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
ip6_route_output_flags (net/ipv6/route.c:2607)
vrf_process_v6_outbound (drivers/net/vrf.c:437)

I was tempted to rework the un-slaving code to clear the flag first
and insert synchronize_rcu() before we remove the upper. But looks like
the explicit fallback to loopback_dev is an established pattern.
And I guess avoiding the synchronize_rcu() is nice, too.

Analysis

Technical impact

This vulnerability is a NULL pointer dereference in the Linux kernel's IPv6 routing code, triggered when a device is un-slaved from a Virtual Routing and Forwarding (VRF) instance. The bug causes the kernel to dereference a NULL pointer during route allocation, leading to a kernel panic and a system reboot. The weakness corresponds to CWE‑476 and results in a denial of service by crashing the operating system.

Affected Systems

Any Linux system running a kernel version that includes the affected IPv6 routing code, regardless of distribution, is potentially vulnerable. The issue is tied to devices that use VRF functionality for IPv6 routing. No specific vendor or version is listed, so all kernels preceding the patch incorporating commit 4832c30d5458 are affected.

Risk and Exploitability

The CVSS score for this issue is 5.5, indicating moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require triggering the VRF un‑slaving process, which is usually a local or privileged operation; thus the attack vector is likely local or requires elevated privileges. Overall, the risk is moderate but the probability of real‑world exploitation is low.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< d542e2ac7f9e288d49735be0775611547ca4e0ee
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< a73fe9f4ae84a239d5b2686f47a58c158aee2eb4
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 4a48fe59f29f673a3d042d679f26629a9c3e29d4
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 581800298313c9fd75e94985e6d37d21b7e35d34
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 3310fc11fc47387d1dd4759b0bc961643ea11c7f
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 0b5a7826020706057cc5a9d9009e667027f221ee
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< ae88c8256547b63980770a9ea7be73a15900d27e
`4832c30d5458387ff2533ff66fbde26ad8bb5a2d`	affected	< 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,4a48fe59f29f673a3d042d679f26629a9c3e29d4)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,581800298313c9fd75e94985e6d37d21b7e35d34)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,3310fc11fc47387d1dd4759b0bc961643ea11c7f)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,0b5a7826020706057cc5a9d9009e667027f221ee)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,ae88c8256547b63980770a9ea7be73a15900d27e)`	affected	code_commit	—
`[4832c30d5458387ff2533ff66fbde26ad8bb5a2d,2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.14`	affected	generic	—
`[0,4.14)`	unaffected	generic	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fix (commit 4832c30d5458).
Reboot the system to ensure the patched kernel is running.
If an immediate kernel upgrade is not possible, consider disabling VRF or preventing un‑slave operations as a temporary containment.

Generated by OpenCVE AI on March 26, 2026 at 02:27 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4606-1	linux security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.137% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee
https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a
https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f
https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4
https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34
https://git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4
https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e
https://git.kernel.org/stable/c/d542e2ac7f9e288d49735be0775611547ca4e0ee
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23304-485b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23304
https://www.cve.org/CVERecord?id=CVE-2026-23304

History

Nov 6, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html https://cert-portal.siemens.com/productcert/html/ssa-784472.html

May 28, 2026 2:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::

Apr 18, 2026 9:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4 https://git.kernel.org/stable/c/d542e2ac7f9e288d49735be0775611547ca4e0ee

Mar 26, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23304-485b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23304 https://www.cve.org/CVERecord?id=CVE-2026-23304
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mar 25, 2026 10:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mar 25, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.
Title		ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4 https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34 https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e