CVE-2026-64569

A flaw of moderate severity was found in the Linux kernel's MPLS subsystem, affecting Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. On kernels built with CONFIG_INET disabled, mpls_valid_fib_dump_req() walks the parsed netlink attribute table itself instead of calling ip_valid_fib_dump_req(), and its RTA_OIF code path passes tb[RTA_OIF] to nla_get_u32() without first checking that the attribute is present. An unprivileged local user can exploit this by sending an RTM_GETROUTE dump request for AF_MPLS with strict checking enabled and without an RTA_OIF attribute, an operation that rtnetlink permits without CAP_NET_ADMIN. The result is a NULL pointer dereference that crashes the kernel, causing a denial of service. Kernel builds with CONFIG_INET enabled are not exposed to this code path because they use ip_valid_fib_dump_req(), which skips unset attributes. Red Hat Enterprise Linux 6 and 7 are listed as not affected because the vulnerable code is not present in those streams. Because the vulnerable path is limited to kernels built with CONFIG_INET disabled, the fix for the affected streams has been deferred to a future update; the residual risk is that an unprivileged local user could trigger a kernel crash and denial of service, but only on such CONFIG_INET=n builds, and there is no impact on confidentiality or integrity. The Red Hat severity of moderate with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects the local, low-privilege attack vector with availability-only impact.