CVE-2026-23439 - Vulnerability Details

- udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n

Description

In the Linux kernel, the following vulnerability has been resolved:

udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n

When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0
(success) without actually creating a socket. Callers such as
fou_create() then proceed to dereference the uninitialized socket
pointer, resulting in a NULL pointer dereference.

The captured NULL deref crash:
BUG: kernel NULL pointer dereference, address: 0000000000000018
RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)
[...]
Call Trace:
<TASK>
genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)
genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)
[...]
netlink_rcv_skb (net/netlink/af_netlink.c:2550)
genl_rcv (net/netlink/genetlink.c:1219)
netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1894)
__sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))
__sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))
__x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))
do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)

This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so
callers correctly take their error paths. There is only one caller of
the vulnerable function and only privileged users can trigger it.

Published: 2026-04-03

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a logic flaw in the udp_tunnel subsystem: when IPv6 support is disabled, the function udp_sock_create6 reports success yet does not create a socket. Callers that expect a valid socket, such as fou_create(), subsequently dereference the null value, causing a kernel panic. The flaw does not compromise confidentiality or integrity; it simply crashes the operating system.

Affected Systems

Linux kernel builds that include the fou (IPIP) module with IPv6 support disabled (CONFIG_IPV6=n). The vulnerability is present in all such builds until the patch is applied.

Risk and Exploitability

CVSS base score 5.5 indicates medium severity. EPSS score below 1% suggests low exploitation probability. The flaw requires a privileged user to trigger the failing path, so the primary attack vector is local privilege or a compromised privileged process. The vulnerability is not listed in CISA KEV and no publicly known exploitation has been reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< dfc96ae0074cc47b5478a59e5aa19233e434243f
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< 66117dbb3dbae82f86735bf727b1d59cc677afa1
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< ba7c9ddcdd077942b798979edb035207374d4096
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< a05a2149386f6dfb4245f522acdbef892acafc84
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< 9f036aa0fe46c19e938f03d10e02c23f4fffae5e
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< 003343985f26dfefd0c94b1fe1316a2de74428b9
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< 12aa4b73a67d95bc739995a2d6943aec2f9785c9
`fd384412e199b62c3ddaabd18dce86d0e164c5b9`	affected	< b3a6df291fecf5f8a308953b65ca72b7fc9e015d

Linux

affected

Version	Status	Constraints
`3.18`	affected	—
`0`	unaffected	< 3.18
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:3.18:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fd384412e199b62c3ddaabd18dce86d0e164c5b9,ba7c9ddcdd077942b798979edb035207374d4096)`	affected	code_commit	—
`[fd384412e199b62c3ddaabd18dce86d0e164c5b9,a05a2149386f6dfb4245f522acdbef892acafc84)`	affected	code_commit	—
`[fd384412e199b62c3ddaabd18dce86d0e164c5b9,9f036aa0fe46c19e938f03d10e02c23f4fffae5e)`	affected	code_commit	—
`[fd384412e199b62c3ddaabd18dce86d0e164c5b9,003343985f26dfefd0c94b1fe1316a2de74428b9)`	affected	code_commit	—
`[fd384412e199b62c3ddaabd18dce86d0e164c5b9,12aa4b73a67d95bc739995a2d6943aec2f9785c9)`	affected	code_commit	—
`[fd384412e199b62c3ddaabd18dce86d0e164c5b9,b3a6df291fecf5f8a308953b65ca72b7fc9e015d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3.18,3.18]`	affected	generic	—
`[0,3.18)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the udp_sock_create6 fix and the subsequent error handling code.
Verify that the kernel configuration either enables CONFIG_IPV6 or that the fou module is not loaded to eliminate the vulnerable code path.
If an immediate kernel update is not possible, block the use of the fou_create interface by unloading the fou module or adding it to a module blacklist.
Keep the system up to date with kernel releases that include the fix and monitor vendor advisories for future updates.

Generated by OpenCVE AI on April 7, 2026 at 10:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/003343985f26dfefd0c94b1fe1316a2de74428b9
https://git.kernel.org/stable/c/12aa4b73a67d95bc739995a2d6943aec2f9785c9
https://git.kernel.org/stable/c/66117dbb3dbae82f86735bf727b1d59cc677afa1
https://git.kernel.org/stable/c/9f036aa0fe46c19e938f03d10e02c23f4fffae5e
https://git.kernel.org/stable/c/a05a2149386f6dfb4245f522acdbef892acafc84
https://git.kernel.org/stable/c/b3a6df291fecf5f8a308953b65ca72b7fc9e015d
https://git.kernel.org/stable/c/ba7c9ddcdd077942b798979edb035207374d4096
https://git.kernel.org/stable/c/dfc96ae0074cc47b5478a59e5aa19233e434243f
https://lore.kernel.org/linux-cve-announce/2026040313-CVE-2026-23439-ed88@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23439
https://www.cve.org/CVERecord?id=CVE-2026-23439

History

Thu, 23 Apr 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:3.18:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/66117dbb3dbae82f86735bf727b1d59cc677afa1 https://git.kernel.org/stable/c/dfc96ae0074cc47b5478a59e5aa19233e434243f

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-393
References		https://lore.kernel.org/linux-cve-announce/2026040313-CVE-2026-23439-ed88@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23439 https://www.cve.org/CVERecord?id=CVE-2026-23439
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference the uninitialized socket pointer, resulting in a NULL pointer dereference. The captured NULL deref crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764) [...] Call Trace: <TASK> genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209) [...] netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1)) __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1)) __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130) This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so callers correctly take their error paths. There is only one caller of the vulnerable function and only privileged users can trigger it.
Title		udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/003343985f26dfefd0c94b1fe1316a2de74428b9 https://git.kernel.org/stable/c/12aa4b73a67d95bc739995a2d6943aec2f9785c9 https://git.kernel.org/stable/c/9f036aa0fe46c19e938f03d10e02c23f4fffae5e https://git.kernel.org/stable/c/a05a2149386f6dfb4245f522acdbef892acafc84 https://git.kernel.org/stable/c/b3a6df291fecf5f8a308953b65ca72b7fc9e015d https://git.kernel.org/stable/c/ba7c9ddcdd077942b798979edb035207374d4096

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:15:23.734Z

Updated: 2026-04-18T08:58:55.464Z

Reserved: 2026-01-13T15:37:46.017Z

Link: CVE-2026-23439

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-03T16:16:25.737

Modified: 2026-04-23T20:59:18.080

Link: CVE-2026-23439

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-23439 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-08T19:54:00Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object