GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89561 (GCVE-0-2026-89561)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:31
VLAI
Title
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL. Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200: BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394 CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: <IRQ> kasan_report+0xc6/0x100 ipv6_rpl_srh_rcv+0xb3/0x1070 ip6_protocol_deliver_rcu+0x759/0x9a0 ip6_input_finish+0xa8/0x1b0 ip6_input+0xe1/0x490 ipv6_rcv+0x33d/0x460 __netif_receive_skb_one_core+0xd6/0x130 process_backlog+0x2cc/0xa00 __napi_poll.constprop.0+0x56/0x270 net_rx_action+0x327/0x730 handle_softirqs+0x11e/0x630 do_softirq+0xb3/0xf0 </IRQ> Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from ipv6_rthdr_rcv(), which already has an idev lookup. Fix the NULL dereference on the RPL path by checking idev in ipv6_rthdr_rcv(), before it calls either function. The callees take idev as an argument and no longer call __in6_dev_get(), so the packet is now dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 , < 63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c (git)
Affected: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 , < eab3a917cdcb182542a3aac6a0d2d30659ca9821 (git)
Affected: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 , < f826df95332c07380206dbd54178b6eefb311aba (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/exthdrs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c",
              "status": "affected",
              "version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
              "versionType": "git"
            },
            {
              "lessThan": "eab3a917cdcb182542a3aac6a0d2d30659ca9821",
              "status": "affected",
              "version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
              "versionType": "git"
            },
            {
              "lessThan": "f826df95332c07380206dbd54178b6eefb311aba",
              "status": "affected",
              "version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/exthdrs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()\n\nipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL\ncheck when reading idev-\u003ecnf.rpl_seg_enabled.\n\nWhen the device\u0027s MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears\ndev-\u003eip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev\ncheck in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with\ndev-\u003eip6_ptr already NULL.\n\nReproduced by flooding the receiving interface with ping6 traffic while\nflapping its MTU between 1500 and 1200:\n\n BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070\n Read of size 4 at addr 00000000000006b4 by task ping6/394\n\n CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)\n Call Trace:\n  \u003cIRQ\u003e\n  kasan_report+0xc6/0x100\n  ipv6_rpl_srh_rcv+0xb3/0x1070\n  ip6_protocol_deliver_rcu+0x759/0x9a0\n  ip6_input_finish+0xa8/0x1b0\n  ip6_input+0xe1/0x490\n  ipv6_rcv+0x33d/0x460\n  __netif_receive_skb_one_core+0xd6/0x130\n  process_backlog+0x2cc/0xa00\n  __napi_poll.constprop.0+0x56/0x270\n  net_rx_action+0x327/0x730\n  handle_softirqs+0x11e/0x630\n  do_softirq+0xb3/0xf0\n  \u003c/IRQ\u003e\n\nBoth ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from\nipv6_rthdr_rcv(), which already has an idev lookup.\n\nFix the NULL dereference on the RPL path by checking idev in\nipv6_rthdr_rcv(), before it calls either function. The callees take idev as\nan argument and no longer call __in6_dev_get(), so the packet is now\ndropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ipv6_rpl_srh_rcv() runs on the IPv6 local-delivery path (ipv6_rcv \u2192 ip6_protocol_deliver_rcu \u2192 ipv6_rthdr_rcv) for any unicast packet with Routing Header type 3; a remote attacker can deliver such packets over the network with no local access.\nAC:L - The attacker drives both sides of the race by flooding type-3 routing-header packets while concurrently dropping the ingress MTU below IPV6_MIN_MTU or deleting the netdev, and the window is large because ip6_rcv_core() drops RCU before extension-header processing.\nPR:N - Sending an unauthenticated IPv6 packet with a type-3 routing header requires no credentials; the NULL deref occurs before the rpl_seg_enabled check, and ip6_ptr teardown also occurs during ordinary container/veth lifecycle on shared hosts.\nUI:N - Exploitation needs only delivery of IPv6 routing-header packets during concurrent interface MTU/teardown; no victim action such as opening a file, mounting a filesystem, or clicking a link is required.\nS:U - A successful trigger oopses the same host kernel that processes the packet and does not cross a VM, hypervisor, IOMMU, or other security-authority boundary.\nC:N - The fault is a pure NULL pointer read of idev-\u003ecnf.rpl_seg_enabled at a fixed offset, causing an immediate page fault with no use-after-free, out-of-bounds read, or other information-disclosure primitive.\nI:N - This is a read-side NULL dereference only; there is no memory write, type confusion, or control-flow hijack primitive beyond crashing the kernel.\nA:H - The NULL dereference occurs in softirq context during IPv6 receive and produces a kernel oops or panic, as shown by the KASAN report in ipv6_rpl_srh_rcv, fully denying availability on the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:01.482Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/eab3a917cdcb182542a3aac6a0d2d30659ca9821"
        },
        {
          "url": "https://git.kernel.org/stable/c/f826df95332c07380206dbd54178b6eefb311aba"
        }
      ],
      "title": "ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89561",
    "datePublished": "2026-09-11T19:44:32.822Z",
    "dateReserved": "2026-09-11T19:38:34.725Z",
    "dateUpdated": "2026-09-13T06:31:01.482Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89561",
      "date": "2026-09-17",
      "epss": "0.00432",
      "percentile": "0.36805"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89561\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:39.933\",\"lastModified\":\"2026-09-13T07:17:22.310\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()\\n\\nipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL\\ncheck when reading idev-\u003ecnf.rpl_seg_enabled.\\n\\nWhen the device\u0027s MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears\\ndev-\u003eip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev\\ncheck in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with\\ndev-\u003eip6_ptr already NULL.\\n\\nReproduced by flooding the receiving interface with ping6 traffic while\\nflapping its MTU between 1500 and 1200:\\n\\n BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070\\n Read of size 4 at addr 00000000000006b4 by task ping6/394\\n\\n CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)\\n Call Trace:\\n  \u003cIRQ\u003e\\n  kasan_report+0xc6/0x100\\n  ipv6_rpl_srh_rcv+0xb3/0x1070\\n  ip6_protocol_deliver_rcu+0x759/0x9a0\\n  ip6_input_finish+0xa8/0x1b0\\n  ip6_input+0xe1/0x490\\n  ipv6_rcv+0x33d/0x460\\n  __netif_receive_skb_one_core+0xd6/0x130\\n  process_backlog+0x2cc/0xa00\\n  __napi_poll.constprop.0+0x56/0x270\\n  net_rx_action+0x327/0x730\\n  handle_softirqs+0x11e/0x630\\n  do_softirq+0xb3/0xf0\\n  \u003c/IRQ\u003e\\n\\nBoth ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from\\nipv6_rthdr_rcv(), which already has an idev lookup.\\n\\nFix the NULL dereference on the RPL path by checking idev in\\nipv6_rthdr_rcv(), before it calls either function. The callees take idev as\\nan argument and no longer call __in6_dev_get(), so the packet is now\\ndropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/exthdrs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3\",\"lessThan\":\"63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3\",\"lessThan\":\"eab3a917cdcb182542a3aac6a0d2d30659ca9821\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3\",\"lessThan\":\"f826df95332c07380206dbd54178b6eefb311aba\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/exthdrs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eab3a917cdcb182542a3aac6a0d2d30659ca9821\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f826df95332c07380206dbd54178b6eefb311aba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T14:05:55+00:00",
      "cve": "CVE-2026-89561",
      "id": "CVE-2026-89561",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89561.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T15:36:46Z",
      "cve": "CVE-2026-89561",
      "id": "CVE-2026-89561",
      "initial_release_date": "2026-09-12T16:26:02Z",
      "product_status:known_affected": "236",
      "product_status:known_not_affected": "117",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89561",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89561.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.