Severity by source
Network-adjacent (AV:A) because NDP operates at link-local scope; no privileges or interaction required; high availability impact from kernel panic, low confidentiality from OOB read.
Lifecycle Timeline
2DescriptionCVE.org
[rx_ndp_na NDP NA missing option length check -- OOB read]
AnalysisAI
Out-of-bounds read in the Linux kernel's IPv6 Neighbor Discovery Protocol stack via the rx_ndp_na handler allows a network-adjacent attacker to trigger a read beyond allocated memory by sending a crafted Neighbor Advertisement packet with a missing or malformed option length field. Affected systems are those running a vulnerable kernel version with IPv6 enabled. Impact is most likely a kernel crash (denial of service) or potential kernel memory disclosure, depending on memory layout at the time of exploitation. No public exploit and no KEV listing identified at time of analysis.
Technical ContextAI
The vulnerability resides in the rx_ndp_na function, which is responsible for processing incoming NDP (Neighbor Discovery Protocol) Neighbor Advertisement (NA) messages - part of ICMPv6 and defined in RFC 4861. NDP is the IPv6 equivalent of ARP and is used for address resolution, router discovery, and neighbor reachability. The missing option length validation means the kernel does not verify that the advertised length field of an NDP option is within bounds before reading it, a pattern consistent with CWE-125 (Out-of-bounds Read). Ubuntu reported this issue, strongly suggesting this affects the upstream Linux kernel as packaged in Debian/Ubuntu distributions. No CPE strings were provided, so exact affected version ranges are inferred rather than confirmed.
Affected ProductsAI
The affected product is the Linux kernel, specifically the IPv6 networking subsystem's NDP Neighbor Advertisement receive path (rx_ndp_na). The vulnerability was reported by Ubuntu's vendor security team. No CPE strings or explicit version ranges were provided in the source data; affected kernel versions must be confirmed against the Ubuntu Security Notice or upstream Linux kernel changelog. Distributions packaging the affected kernel version - including Ubuntu and Debian derivatives - should be assessed.
RemediationAI
No exact patch version was provided in the input data. Ubuntu reported this issue, so the primary remediation action is to monitor the Ubuntu Security Notices (https://ubuntu.com/security/notices) and the upstream Linux kernel mailing list for a fix targeting the rx_ndp_na path. As a compensating control, administrators can disable IPv6 on interfaces where it is not operationally required using 'sysctl -w net.ipv6.conf.all.disable_ipv6=1', which prevents NDP packets from being processed entirely; the trade-off is loss of all IPv6 connectivity on those interfaces. Where IPv6 is required, restricting ICMPv6 Neighbor Advertisement messages at the perimeter firewall to only trusted link-local sources can reduce the network-accessible attack surface. Apply the vendor-released kernel patch as soon as Ubuntu publishes it; kernel live-patching (via Canonical Livepatch or kpatch) should be considered for production systems that cannot tolerate a reboot window.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today