CVE-2026-80646 - Vulnerability Details

- ipv6: guard against possible NULL deref in __in6_dev_stats_get()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: guard against possible NULL deref in __in6_dev_stats_get()

dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.

Found by Sashiko.

Published: 2026-08-28

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the Linux kernel’s IPv6 stack and allows a NULL pointer dereference when __in6_dev_stats_get() is called after the underlying network device has been unregistered, which can trigger a kernel fault that may halt the system or disrupt networking services. This flaw is a classic NULL pointer dereference (CWE-476) and no CVSS score is publicly available.

Affected Systems

All Linux kernel releases that include the __in6_dev_stats_get() function without the added null check are affected. This includes every kernel version built before the commit that introduced the guard. Upgrading to a kernel that contains the null‑check fix resolves the issue for all architectures.

Risk and Exploitability

No CVSS, EPSS, or KEV information is provided, and no public exploits are known for this flaw. Reaching the vulnerable code path likely requires local or privileged execution to cause device unregistration and trigger the IPv6 statistics routine. While the potential impact of a system crash is high, the likelihood of exploitation in the wild appears limited according to the available data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< a23f2c68c6635e41404f189f8f7ae910738cebdb
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< e14db43677946bf2095febd294bb3c13ab375ab7
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< 1a4adfbeb47a212a64539137411f1ca168474d33
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< 1e3db30a88815bae6e9d5db6f64ac735e615a07e
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< 952426a83ca75cea25c09d58944abafaa3ebd242
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< 0db1949084e85a72d174a7dea3259b94fe5a9305
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< fc920c0659cdea5afd8721c1155a51564859e075
`e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f`	affected	< 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc
`a24963500a4ec921ce9c2597e0a584e44513afae`	affected	—
`4.19.291`	affected	< 4.20

Linux

affected

Version	Status	Constraints
`5.2`	affected	—
`0`	unaffected	< 5.2
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,a23f2c68c6635e41404f189f8f7ae910738cebdb)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,e14db43677946bf2095febd294bb3c13ab375ab7)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,1a4adfbeb47a212a64539137411f1ca168474d33)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,1e3db30a88815bae6e9d5db6f64ac735e615a07e)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,952426a83ca75cea25c09d58944abafaa3ebd242)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,0db1949084e85a72d174a7dea3259b94fe5a9305)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,fc920c0659cdea5afd8721c1155a51564859e075)`	affected	code_commit	—
`[e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f,507541c2a8eeb76c02bd2511958f73a8cfa3e1bc)`	affected	code_commit	—
`a24963500a4ec921ce9c2597e0a584e44513afae`	affected	code_commit	—
`[4.19.291,4.20)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.2`	affected	generic	—
`[0,5.2)`	unaffected	generic	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that includes the null‑check modification for __in6_dev_stats_get()
Reboot the system or reload the kernel to ensure the patched code is active
Verify kernel stability by monitoring system logs for any IPv6‑related panics and confirm that networking services continue to operate normally

Generated by OpenCVE AI on August 28, 2026 at 12:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0db1949084e85a72d174a7dea3259b94fe5a9305
https://git.kernel.org/stable/c/1a4adfbeb47a212a64539137411f1ca168474d33
https://git.kernel.org/stable/c/1e3db30a88815bae6e9d5db6f64ac735e615a07e
https://git.kernel.org/stable/c/507541c2a8eeb76c02bd2511958f73a8cfa3e1bc
https://git.kernel.org/stable/c/952426a83ca75cea25c09d58944abafaa3ebd242
https://git.kernel.org/stable/c/a23f2c68c6635e41404f189f8f7ae910738cebdb
https://git.kernel.org/stable/c/e14db43677946bf2095febd294bb3c13ab375ab7
https://git.kernel.org/stable/c/fc920c0659cdea5afd8721c1155a51564859e075

History

Fri, 28 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.
Title		ipv6: guard against possible NULL deref in __in6_dev_stats_get()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0db1949084e85a72d174a7dea3259b94fe5a9305 https://git.kernel.org/stable/c/1a4adfbeb47a212a64539137411f1ca168474d33 https://git.kernel.org/stable/c/1e3db30a88815bae6e9d5db6f64ac735e615a07e https://git.kernel.org/stable/c/507541c2a8eeb76c02bd2511958f73a8cfa3e1bc https://git.kernel.org/stable/c/952426a83ca75cea25c09d58944abafaa3ebd242 https://git.kernel.org/stable/c/a23f2c68c6635e41404f189f8f7ae910738cebdb https://git.kernel.org/stable/c/e14db43677946bf2095febd294bb3c13ab375ab7 https://git.kernel.org/stable/c/fc920c0659cdea5afd8721c1155a51564859e075

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:48:56.277Z

Updated: 2026-08-28T06:48:56.277Z

Reserved: 2026-08-26T14:34:25.779Z

Link: CVE-2026-80646

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:49.550

Modified: 2026-08-28T08:16:49.550

Link: CVE-2026-80646

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-28T12:15:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object