CVE-2026-53214 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix a potential NPD in cleanup_prefix_route()

addrconf_get_prefix_route() can return the fib6_null_entry sentinel
entry which has a NULL fib6_table pointer. Therefore, before setting the
route's expiration time, check that we are not working with this entry,
as otherwise a NPD will be triggered [1].

Note that the other callers of addrconf_get_prefix_route() are not
susceptible to this bug:

1. addrconf_prefix_rcv(): Requests a route with the 'RTF_ADDRCONF |
RTF_PREFIX_RT' flags which are not set on fib6_null_entry.

2. modify_prefix_route(): Fixed by commit a747e02430df ("ipv6: avoid
possible NULL deref in modify_prefix_route()").

3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for
fib6_null_entry and returns an error.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[...]
Call Trace:
<TASK>
__kasan_check_byte (mm/kasan/common.c:573)
lock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1))
_raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1))
cleanup_prefix_route (net/ipv6/addrconf.c:1280)
ipv6_del_addr (net/ipv6/addrconf.c:1342)
inet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119)
inet6_rtm_deladdr (net/ipv6/addrconf.c:4812)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6997)
netlink_rcv_skb (net/netlink/af_netlink.c:2555)
netlink_unicast (net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1899)
__sock_sendmsg (net/socket.c:802 (discriminator 4))
____sys_sendmsg (net/socket.c:2698)
___sys_sendmsg (net/socket.c:2752)
__sys_sendmsg (net/socket.c:2784)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Published: 2026-06-25

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is in the Linux kernel's IPv6 address configuration code. A function can return a sentinel entry whose fib6_table pointer is NULL, and cleanup_prefix_route() attempts to use that pointer without validation. This results in a null pointer dereference, causing a general protection fault and a kernel crash, which equates to a denial‑of‑service condition for the affected host.

Affected Systems

Any Linux kernel that implements IPv6 address configuration before the patch series referencing commit 07d9a0870a178843cea44cfd58c27445dc94cf5f remains vulnerable. The update is present in the mainline kernel starting with that commit, so all Linux derivatives that have not applied the change are at risk.

Risk and Exploitability

No CVSS or EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited known exploitation data. Achieving the fault requires interaction with IPv6 address configuration functions, which could be triggered by external traffic or local system activity. While it does not enable arbitrary code execution, the resulting system crash presents a serious availability risk, especially for services requiring high uptime.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd12abe294c7738421bdfbc486f1909d02db30e9`	affected	< 5f82b02b4059ddc06e4fcfd057bfb59fd6885cd2
`5eb902b8e7193cdcb33242af0a56502e6b5206e9`	affected	< 192df376a05c2db15564640f9da7e20907c1fa24
`5eb902b8e7193cdcb33242af0a56502e6b5206e9`	affected	< 07d9a0870a178843cea44cfd58c27445dc94cf5f
`5eb902b8e7193cdcb33242af0a56502e6b5206e9`	affected	< 653a2849305708f75260b5296f17b2a759ff9cc7
`5eb902b8e7193cdcb33242af0a56502e6b5206e9`	affected	< b70c687b7cf267fb08586667a3946c8851cad672
`6.6.120`	affected	< 6.6.143

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that contains the commit 07d9a0870a or later; this patch removes the unchecked pointer use.
Reboot the system after the kernel update so the new code is loaded.
Continuously monitor system logs for KASAN or “general protection fault” messages to detect accidental execution paths.
If an update cannot be applied immediately, consider disabling IPv6 on the affected hosts by setting net.ipv6.conf.all.disable_ipv6=1 (and similarly for individual interfaces) to prevent the vulnerable code from being exercised.

Generated by OpenCVE AI on June 25, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07d9a0870a178843cea44cfd58c27445dc94cf5f
https://git.kernel.org/stable/c/192df376a05c2db15564640f9da7e20907c1fa24
https://git.kernel.org/stable/c/5f82b02b4059ddc06e4fcfd057bfb59fd6885cd2
https://git.kernel.org/stable/c/653a2849305708f75260b5296f17b2a759ff9cc7
https://git.kernel.org/stable/c/b70c687b7cf267fb08586667a3946c8851cad672

History

Thu, 25 Jun 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix a potential NPD in cleanup_prefix_route() addrconf_get_prefix_route() can return the fib6_null_entry sentinel entry which has a NULL fib6_table pointer. Therefore, before setting the route's expiration time, check that we are not working with this entry, as otherwise a NPD will be triggered [1]. Note that the other callers of addrconf_get_prefix_route() are not susceptible to this bug: 1. addrconf_prefix_rcv(): Requests a route with the 'RTF_ADDRCONF \| RTF_PREFIX_RT' flags which are not set on fib6_null_entry. 2. modify_prefix_route(): Fixed by commit a747e02430df ("ipv6: avoid possible NULL deref in modify_prefix_route()"). 3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for fib6_null_entry and returns an error. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [...] Call Trace: <TASK> __kasan_check_byte (mm/kasan/common.c:573) lock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1)) _raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1)) cleanup_prefix_route (net/ipv6/addrconf.c:1280) ipv6_del_addr (net/ipv6/addrconf.c:1342) inet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119) inet6_rtm_deladdr (net/ipv6/addrconf.c:4812) rtnetlink_rcv_msg (net/core/rtnetlink.c:6997) netlink_rcv_skb (net/netlink/af_netlink.c:2555) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1899) __sock_sendmsg (net/socket.c:802 (discriminator 4)) ____sys_sendmsg (net/socket.c:2698) ___sys_sendmsg (net/socket.c:2752) __sys_sendmsg (net/socket.c:2784) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Title		ipv6: Fix a potential NPD in cleanup_prefix_route()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07d9a0870a178843cea44cfd58c27445dc94cf5f https://git.kernel.org/stable/c/192df376a05c2db15564640f9da7e20907c1fa24 https://git.kernel.org/stable/c/5f82b02b4059ddc06e4fcfd057bfb59fd6885cd2 https://git.kernel.org/stable/c/653a2849305708f75260b5296f17b2a759ff9cc7 https://git.kernel.org/stable/c/b70c687b7cf267fb08586667a3946c8851cad672

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:18.209Z

Updated: 2026-06-25T08:39:18.209Z

Reserved: 2026-06-09T07:44:35.392Z

Link: CVE-2026-53214

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-25T11:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object