HIGH
ipv6 InDevStats Deref
CVE-2026-80646
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.
02KernelScan AI Analysis
Risk summary
A NULL pointer dereference in the IPv6 statistics path can be triggered when a VRF master device's underlying physical interface is unregistered while IPv6 traffic is being processed. This results in a kernel panic, causing a denial of service. The issue is reachable locally by users with network configuration privileges.
Vulnerability analysis
When an IPv6 packet arrives on a VRF master device, the kernel looks up the original physical interface to update ICMPv6 statistics. If that physical device has been unregistered in the meantime, the lookup returns NULL and the code dereferences it, causing a kernel panic. The fix adds a NULL check after the device lookup and returns NULL instead of proceeding, preventing the dereference. This path is reachable from local network configuration contexts where VRF is in use and requires privileges to set up VRF devices.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.19 | 4.19.291 | 4.20 | a23f2c68c663 |
| 5.10 | — | 5.10.261 | e14db4367794 |
| 5.15 | — | 5.15.212 | 1a4adfbeb47a |
| 6.1 | — | 6.1.178 | 1e3db30a8881 |
| 6.12 | — | 6.12.97 | 0db1949084e8 |
| 6.18 | — | 6.18.40 | fc920c0659cd |
| 6.6 | — | 6.6.145 | 952426a83ca7 |
| 7.1 | — | 7.1.5 | 507541c2a8ee |
| mainline | — | 7.2 | — |
| cip/4.19 | — | 4.19.325-cip136 | 84eb9cb37df0 |
| cip/4.19-rt | — | 4.19.325-cip136-rt50 | 84eb9cb37df0 |
| cip/5.10 | — | 5.10.263-cip76 | a23f2c68c663 |
| cip/5.10-rt | — | 5.10.268-cip77-rt34 | a23f2c68c663 |
| cip/6.1 | — | 6.1.182-cip59 | 1a4adfbeb47a |
| cip/6.1-rt | — | 6.1.182-cip59-rt31 | 1a4adfbeb47a |
| cip/6.12 | — | 6.12.101-cip29 | 952426a83ca7 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.182-cip59 |
| cip/6.1-rt | Fixed in 6.1.182-cip59-rt31 |
| cip/5.10 | Fixed in 5.10.263-cip76 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |