CVE-2026-23381
Description
A flaw was found in the Linux kernel's network bridging component. When Internet Protocol version 6 (IPv6) is explicitly disabled, a critical data structure for Neighbor Discovery is not properly initialized. A remote attacker could exploit this by sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Neighbor Discovery packet. This could lead to a kernel NULL pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).
Statement
This flaw affects bridge configurations with neigh_suppress enabled while IPv6 is disabled via ipv6.disable=1. When ICMPv6 ND packets reach the bridge, br_do_suppress_nd() dereferences the uninitialized nd_tbl, causing a NULL pointer crash. Similar to CVE-2026-23293 but affects bridge instead of VXLAN.
Mitigation
Do not use the ipv6.disable=1 boot parameter on systems using network bridging with neighbor suppression, or disable neigh_suppress on bridges when IPv6 is disabled.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
