HIGH Introduced in 5.7
ipv6 RplSrh Deref
CVE-2026-89561
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI4.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL. Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200: BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394 CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: <IRQ> kasan_report+0xc6/0x100 ipv6_rpl_srh_rcv+0xb3/0x1070 ip6_protocol_deliver_rcu+0x759/0x9a0 ip6_input_finish+0xa8/0x1b0 ip6_input+0xe1/0x490 ipv6_rcv+0x33d/0x460 __netif_receive_skb_one_core+0xd6/0x130 process_backlog+0x2cc/0xa00 __napi_poll.constprop.0+0x56/0x270 net_rx_action+0x327/0x730 handle_softirqs+0x11e/0x630 do_softirq+0xb3/0xf0 </IRQ> Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from ipv6_rthdr_rcv(), which already has an idev lookup. Fix the NULL dereference on the RPL path by checking idev in ipv6_rthdr_rcv(), before it calls either function. The callees take idev as an argument and no longer call __in6_dev_get(), so the packet is now dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
02KernelScan AI Analysis
Risk summary
A local attacker who can change a network interface's MTU while IPv6 traffic is flowing can trigger a NULL pointer dereference in the kernel's RPL Segment Routing Header processing, causing a kernel panic. The race window is narrow and requires timing packet floods against MTU changes. Unprivileged users can reach this via user namespaces, which grant the needed CAP_NET_ADMIN in a private network namespace.
Vulnerability analysis
The kernel's IPv6 RPL Segment Routing Header handler dereferences a per-interface IPv6 configuration pointer obtained from the network device without checking for NULL. When an interface's MTU drops below the IPv6 minimum, a teardown routine asynchronously clears that pointer, but IPv6 packets already past the initial receive check can still reach the RPL handler and hit the NULL dereference. The fix moves the missing NULL check into the common routing-header dispatch path so that packets are dropped cleanly when IPv6 is being torn down on the interface, rather than crashing inside the RPL handler. A local attacker with the ability to change an interface MTU — obtainable without real root through a user namespace — can trigger this by flooding IPv6 packets while toggling the MTU, causing a kernel panic.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 5.7 | 6.18.50 | 63f50e9f90d0 |
| mainline | 5.7 | 7.3-rc1 | f826df95332c |
| 6.12 | 5.7 | 6.12.111 | e7123e10c86e |
| 7.2 | 5.7 | 7.2.4 | eab3a917cdcb |
| cip/6.12 | 5.7 | 6.12.111-cip32 | e7123e10c86e |