CVE-2026-64569 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed
attribute table itself instead of calling ip_valid_fib_dump_req(). The
RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is
present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no
RTA_OIF hits a NULL dereference.

RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without
CAP_NET_ADMIN, so an unprivileged user can trigger it.

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
Call Trace:
mpls_dump_routes (net/mpls/af_mpls.c:2236)
netlink_dump (net/netlink/af_netlink.c:2331)
__netlink_dump_start (net/netlink/af_netlink.c:2446)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)
netlink_rcv_skb (net/netlink/af_netlink.c:2556)
netlink_unicast (net/netlink/af_netlink.c:1345)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
__sock_sendmsg (net/socket.c:790)
____sys_sendmsg (net/socket.c:2684)
___sys_sendmsg (net/socket.c:2738)
__sys_sendmsg (net/socket.c:2770)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Skip unset attributes, as ip_valid_fib_dump_req() does.

Published: 2026-08-05

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability stems from a missing presence check on an optional OIF attribute in the MPLS routing code. When an unprivileged local user sends an RTM_GETROUTE netlink message for the AF_MPLS family on a kernel built with CONFIG_INET disabled, the function mpls_valid_fib_dump_req() dereferences a null pointer. This causes a general protection fault that brings the entire kernel down, resulting in a denial of service for the host.

Affected Systems

All Linux kernel installations compiled with the IPv4 stack disabled (CONFIG_INET=n) that expose the MPLS routing interface. The advisory does not list specific kernel versions, so any kernel built under these conditions that has not yet incorporated the upstream fix is potentially vulnerable.

Risk and Exploitability

The exploit does not require elevated privileges; the kernel accepts RTM_GETROUTE messages without CAP_NET_ADMIN. Therefore, any local user can trigger the crash. No EPSS score is available and the vulnerability is not in the CISA KEV catalog, but the local denial‑of‑service impact makes it a high‑risk issue for affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`196cfebf897266c3450519e916bab9daff74e52c`	affected	< d6eee7cd078aaf9dd75efc801f6c9b608a37cd71
`196cfebf897266c3450519e916bab9daff74e52c`	affected	< ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce
`196cfebf897266c3450519e916bab9daff74e52c`	affected	< 5f6e7b32bd1fbde10fd31a4143260735ea535b8a
`196cfebf897266c3450519e916bab9daff74e52c`	affected	< 06db79411a280707c7e4bf4b221ff4e664b51502
`196cfebf897266c3450519e916bab9daff74e52c`	affected	< 56d96fededd61192cd7cc8d2b0f36adfd59036c3

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[196cfebf897266c3450519e916bab9daff74e52c,d6eee7cd078aaf9dd75efc801f6c9b608a37cd71)`	affected	code_commit	—
`[196cfebf897266c3450519e916bab9daff74e52c,ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce)`	affected	code_commit	—
`[196cfebf897266c3450519e916bab9daff74e52c,5f6e7b32bd1fbde10fd31a4143260735ea535b8a)`	affected	code_commit	—
`[196cfebf897266c3450519e916bab9daff74e52c,06db79411a280707c7e4bf4b221ff4e664b51502)`	affected	code_commit	—
`[196cfebf897266c3450519e916bab9daff74e52c,56d96fededd61192cd7cc8d2b0f36adfd59036c3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	semver	—
`[6.6.148,7.0.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that includes the upstream patch fixing the null dereference in mpls_valid_fib_dump_req().
If an upgrade is not immediately possible, rebuild the kernel with CONFIG_INET enabled or apply a local patch that adds a presence check before accessing the OIF attribute.
As an interim protective measure, filter or block RTM_GETROUTE netlink messages for AF_MPLS from non‑privileged users using firewall or netlink filter rules.

Generated by OpenCVE AI on August 5, 2026 at 09:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06db79411a280707c7e4bf4b221ff4e664b51502
https://git.kernel.org/stable/c/56d96fededd61192cd7cc8d2b0f36adfd59036c3
https://git.kernel.org/stable/c/5f6e7b32bd1fbde10fd31a4143260735ea535b8a
https://git.kernel.org/stable/c/ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce
https://git.kernel.org/stable/c/d6eee7cd078aaf9dd75efc801f6c9b608a37cd71

History

Wed, 05 Aug 2026 10:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 05 Aug 2026 08:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does.
Title		mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06db79411a280707c7e4bf4b221ff4e664b51502 https://git.kernel.org/stable/c/56d96fededd61192cd7cc8d2b0f36adfd59036c3 https://git.kernel.org/stable/c/5f6e7b32bd1fbde10fd31a4143260735ea535b8a https://git.kernel.org/stable/c/ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce https://git.kernel.org/stable/c/d6eee7cd078aaf9dd75efc801f6c9b608a37cd71

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-05T08:08:07.233Z

Updated: 2026-08-05T08:08:07.233Z

Reserved: 2026-07-19T15:36:31.797Z

Link: CVE-2026-64569

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-05T10:45:07Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object