CVE-2026-89561 - Vulnerability Details

- ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL
check when reading idev->cnf.rpl_seg_enabled.

When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears
dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev
check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with
dev->ip6_ptr already NULL.

Reproduced by flooding the receiving interface with ping6 traffic while
flapping its MTU between 1500 and 1200:

BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070
Read of size 4 at addr 00000000000006b4 by task ping6/394

CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)
Call Trace:
<IRQ>
kasan_report+0xc6/0x100
ipv6_rpl_srh_rcv+0xb3/0x1070
ip6_protocol_deliver_rcu+0x759/0x9a0
ip6_input_finish+0xa8/0x1b0
ip6_input+0xe1/0x490
ipv6_rcv+0x33d/0x460
__netif_receive_skb_one_core+0xd6/0x130
process_backlog+0x2cc/0xa00
__napi_poll.constprop.0+0x56/0x270
net_rx_action+0x327/0x730
handle_softirqs+0x11e/0x630
do_softirq+0xb3/0xf0
</IRQ>

Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from
ipv6_rthdr_rcv(), which already has an idev lookup.

Fix the NULL dereference on the RPL path by checking idev in
ipv6_rthdr_rcv(), before it calls either function. The callees take idev as
an argument and no longer call __in6_dev_get(), so the packet is now
dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference in the IPv6 RPL segment routing header handling path can cause the Linux kernel to crash when the interface MTU falls below the minimum IPv6 threshold. The missing null check allows an attacker to trigger a kernel panic, effectively denying service to all users on the affected system. The vulnerability is a classic NULL dereference fault (CWE‑476).

Affected Systems

All Linux kernel implementations prior to the commit that adds the NULL‑check in ipv6_rthdr_rcv() are affected. Versions without the fix will crash when an SRH packet is processed on an interface whose MTU is temporarily lowered below IPV6_MIN_MTU.

Risk and Exploitability

Based on the description, it is inferred that the attack vector requires sending IPv6 packets containing a segment routing header to the target interface while the interface MTU is manipulated. The EPSS score of < 1% indicates a low probability of exploitation, yet the CVSS score of 7.5 reflects high severity. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< e7123e10c86eb88eaa90537dd1f232706de2d308
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< 63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< eab3a917cdcb182542a3aac6a0d2d30659ca9821
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< f826df95332c07380206dbd54178b6eefb311aba

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`6.12.111`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c)`	affected	code_commit	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,eab3a917cdcb182542a3aac6a0d2d30659ca9821)`	affected	code_commit	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,f826df95332c07380206dbd54178b6eefb311aba)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the NULL‑check commit in ipv6_rthdr_rcv().
If a patch is not yet available, configure firewall or sysctl rules to drop segment routing header packets, preventing the vulnerability from being triggered.
Do not lower an interface’s MTU below the IPv6 minimum threshold; maintain MTU values above the minimum to prevent the dereference condition.

Generated by OpenCVE AI on September 15, 2026 at 23:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0063.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c
https://git.kernel.org/stable/c/e7123e10c86eb88eaa90537dd1f232706de2d308
https://git.kernel.org/stable/c/eab3a917cdcb182542a3aac6a0d2d30659ca9821
https://git.kernel.org/stable/c/f826df95332c07380206dbd54178b6eefb311aba
https://nvd.nist.gov/vuln/detail/CVE-2026-89561
https://www.cve.org/CVERecord?id=CVE-2026-89561

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/e7123e10c86eb88eaa90537dd1f232706de2d308

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89561 https://www.cve.org/CVERecord?id=CVE-2026-89561
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 12 Sep 2026 10:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL. Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200: BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394 CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: <IRQ> kasan_report+0xc6/0x100 ipv6_rpl_srh_rcv+0xb3/0x1070 ip6_protocol_deliver_rcu+0x759/0x9a0 ip6_input_finish+0xa8/0x1b0 ip6_input+0xe1/0x490 ipv6_rcv+0x33d/0x460 __netif_receive_skb_one_core+0xd6/0x130 process_backlog+0x2cc/0xa00 __napi_poll.constprop.0+0x56/0x270 net_rx_action+0x327/0x730 handle_softirqs+0x11e/0x630 do_softirq+0xb3/0xf0 </IRQ> Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from ipv6_rthdr_rcv(), which already has an idev lookup. Fix the NULL dereference on the RPL path by checking idev in ipv6_rthdr_rcv(), before it calls either function. The callees take idev as an argument and no longer call __in6_dev_get(), so the packet is now dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
Title		ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c https://git.kernel.org/stable/c/eab3a917cdcb182542a3aac6a0d2d30659ca9821 https://git.kernel.org/stable/c/f826df95332c07380206dbd54178b6eefb311aba

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:32.822Z

Updated: 2026-09-21T13:14:27.162Z

Reserved: 2026-09-11T19:38:34.725Z

Link: CVE-2026-89561

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:39.933

Modified: 2026-09-21T14:17:23.290

Link: CVE-2026-89561

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:32Z

Links: CVE-2026-89561 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T23:15:15Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object