PT-2026-27658 · Linux · Linux

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-23293

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: vxlan: fix nd tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the nd tbl is never initialized because inet6 init() exits before ndisc init() is called which initializes it. If an IPv6 packet is injected into the interface, route shortcircuit() is called and a NULL pointer dereference happens on neigh lookup().

BUG: kernel NULL pointer dereference, address: 0000000000000380 Oops: Oops: 0000 [#1] SMP NOPTI [...] RIP: 0010:neigh lookup+0x20/0x270 [...] Call Trace: vxlan xmit+0x638/0x1ef0 [vxlan] dev hard start xmit+0x9e/0x2e0 dev queue xmit+0xbee/0x14e0 packet sendmsg+0x116f/0x1930 sys sendto+0x1f5/0x200 x64 sys sendto+0x24/0x30 do syscall 64+0x12f/0x1590 entry SYSCALL 64 after hwframe+0x76/0x7e

Fix this by adding an early check on route shortcircuit() when protocol is ETH P IPV6. Note that ipv6 mod enabled() cannot be used here because VXLAN can be built-in even when IPv6 is built as a module.

Related Identifiers

CVE-2026-23293

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-23293 · Security Note
• https://git.kernel.org/stable/c/f0373e9317bc904e7bdb123d3106fe4f3cea2fb7 · Note
• https://git.kernel.org/stable/c/abcd48ecdeb2e12eccb8339a35534c757782afcd · Note
• https://git.kernel.org/stable/c/5f93e6b4d12bd3a4517a6d447ea675f448f21434 · Note
• https://git.kernel.org/stable/c/b5190fcd75a1f1785c766a8d1e44d3938e168f45 · Note
• https://git.kernel.org/stable/c/168ff39e4758897d2eee4756977d036d52884c7e · Note
• https://git.kernel.org/stable/c/fbbd2118982c55fb9b0a753ae0cf7194e77149fb · Note