PT-2026-51906 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-53012
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
nexthop: fix IPv6 route referencing IPv4 nexthop
syzbot reported a panic [1] [2].
When an IPv6 nexthop is replaced with an IPv4 nexthop, the has v4 flag
of all groups containing this nexthop is not updated. This is because
nh group v4 update is only called when replacing AF INET to AF INET6,
but the reverse direction (AF INET6 to AF INET) is missed.
This allows a stale has v4=false to bypass fib6 check nexthop, causing
IPv6 routes to be attached to groups that effectively contain only AF INET
members. Subsequent route lookups then call nexthop fib6 nh() which
returns NULL for the AF INET member, leading to a NULL pointer
dereference.
Fix by calling nh group v4 update whenever the family changes, not just
AF INET to AF INET6.
Reproducer:
# AF INET6 blackhole
ip -6 nexthop add id 1 blackhole
# group with has v4=false
ip nexthop add id 100 group 1
# replace with AF INET (no -6), has v4 stays false
ip nexthop replace id 1 blackhole
# pass stale has v4 check
ip -6 route add 2001:db8::/64 nhid 100
# panic
ping -6 2001:db8::1
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux