PT-2026-27658 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-04-23 · CVE-2026-23293

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s VXLAN implementation. When the system boots with IPv6 disabled ('ipv6.disable=1'), the necessary network table (nd tbl) is not initialized, leading to a potential NULL pointer dereference within the neigh lookup() function when an IPv6 packet is received. This can result in a kernel panic, as indicated by a 'BUG: kernel NULL pointer dereference' message. The issue occurs during packet transmission via the vxlan xmit() function, triggered by calls to route shortcircuit() when processing IPv6 packets. The vulnerable function is neigh lookup().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-23293

ECHO-A740-3F6A-7695

OESA-2026-1862

OESA-2026-1863

OESA-2026-1864

OPENSUSE-SU-2026:20572-1

SUSE-SU-2026:1342-1

SUSE-SU-2026:1573-1

SUSE-SU-2026:1575-1

SUSE-SU-2026:1643-1

SUSE-SU-2026:1661-1

SUSE-SU-2026:2068-1

SUSE-SU-2026:21114-1

SUSE-SU-2026:21123-1

SUSE-SU-2026:21237-1

SUSE-SU-2026:21255-1

SUSE-SU-2026:21352-1

SUSE-SU-2026:21361-1

Affected Products

Linux Kernel

References · 275

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23293.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23274 · Security Note
• https://git.kernel.org/stable/c/168ff39e4758897d2eee4756977d036d52884c7e · Patch
• https://git.kernel.org/stable/c/649e2bb74da54c96cf20729001e283626a2fefa0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23231 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:21123-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31788 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23362 · Security Note
• https://git.kernel.org/stable/c/b5190fcd75a1f1785c766a8d1e44d3938e168f45 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23371 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23303 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23392 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1575-1 · Vendor Advisory