CVE-2026-64538
Description
A flaw was found in the Linux kernel's IPv6 networking component. A null pointer dereference vulnerability exists in the fib6_nh_mtu_change() function. This can occur when the idev (in6_device) pointer is cleared during network interface shutdown, but the fib6_nh_mtu_change() function attempts to dereference it without a proper null check. An attacker could potentially trigger this condition, leading to a kernel crash and a Denial of Service (DoS).
Statement
A flaw was found in the Linux kernel IPv6 routing implementation. The fib6_nh_mtu_change() function re-fetches the associated inet6_dev (idev) pointer via __in6_dev_get() and dereferences idev->cnf.mtu6 without a NULL check. When a network interface is brought down, addrconf_ifdown() clears the device IPv6 pointer (dev->ip6_ptr) while nexthop-backed routes can still reference the interface during the teardown window. If an incoming ICMPv6 Router Advertisement drives an MTU update on one of these routes, via icmpv6_rcv(), ndisc_router_discovery(), and rt6_mtu_change(), while the interface teardown race is in progress, fib6_nh_mtu_change() can observe a NULL idev and crash. This is classified as CWE-476 (NULL Pointer Dereference) and results in a kernel oops or crash, a denial of service only. There is no confidentiality or integrity impact, since the fault occurs on a NULL pointer read with no further data exposure or corruption. Triggering the flaw requires an attacker on the same local network segment (adjacent) sending ICMPv6 Router Advertisement traffic while the target interface happens to be undergoing teardown, a timing condition outside the attacker's control. Fixed upstream in the Linux kernel via commit 46c3b8191aad3d032776bf3bebf03efdf5f4b905.
Mitigation
There is no mitigation for this issue other than applying the fix. Exploitation requires an attacker on the same local network segment as the target, and requires a network interface carrying nexthop-backed IPv6 routes to be undergoing teardown at the same time an ICMPv6 Router Advertisement is processed against it, a race window that is not reliably controllable by an attacker.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Adjacent Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
Corrected CVSS vector and score after further technical review of the upstream fix. (a) AV:A because ICMPv6 Router Advertisements are link-local multicast traffic sent with hop limit 255, and routers do not forward packets with this hop limit (RFC 4861), so exploitation is confined to the local network segment, not local host access (AV:L) and not routable network-wide (AV:N). (b) PR:N because no privileges on the target are required for it to process an incoming Router Advertisement. (c) C:N/I:N because the actual upstream fix (kernel commit 46c3b8191aad3d032776bf3bebf03efdf5f4b905) is a 3-line NULL-check-and-early-return before dereferencing idev->cnf.mtu6, confirming this is a pure crash and denial-of-service primitive, with no data read or write beyond the fault and no confidentiality or integrity impact. (d) AC:H because triggering the crash requires the target interface to be mid-teardown (addrconf_ifdown race, dev->ip6_ptr already cleared) at the same time a Router Advertisement drives the MTU update path, a timing condition beyond the attacker's control. This correction was informed in part by a Product Security automated triage note already on this flaw (from mcascell@redhat.com, 2026-07-28) that independently flagged AV:A and C:N/I:N as the likely-correct values; that hint was cross-verified here against the actual upstream kernel commit before applying.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Integrity,Confidentiality
Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
