Severity by source
Link-adjacent attack vector (ICMPv6 NS is link-local scoped); unauthenticated; OOB read enables kernel memory leak (C:L) and potential kernel crash (A:H); no integrity impact.
Lifecycle Timeline
2DescriptionCVE.org
[rx_ndp_ns ICMPv6 NS minimum length insufficient -- OOB read]
AnalysisAI
Out-of-bounds read in the Linux kernel's ICMPv6 Neighbor Discovery Protocol handler (rx_ndp_ns) exposes systems with IPv6 enabled to memory disclosure or kernel crash via a crafted Neighbor Solicitation packet. The minimum length validation for incoming ICMPv6 NS messages is insufficient, allowing a link-adjacent unauthenticated attacker to trigger the read by sending a malformed packet below the expected minimum size. No public exploit has been identified at time of analysis, and EPSS and KEV data are not yet available for this CVE.
Technical ContextAI
ICMPv6 Neighbor Solicitation (NS) messages are part of the Neighbor Discovery Protocol (NDP, RFC 4861) and are used in IPv6 for address resolution, duplicate address detection, and router discovery. The kernel function rx_ndp_ns handles incoming NS packets. The vulnerability arises because the function does not enforce a strict minimum packet length before accessing fixed-offset fields within the ICMPv6 payload, constituting an out-of-bounds read (CWE class: improper validation of array index / insufficient length check). OOB reads in kernel network receive paths can leak kernel memory contents to an attacker or, depending on what memory is read and how results are used, cause a kernel NULL dereference or panic. Ubuntu is the reporting vendor, strongly indicating the affected component is the upstream Linux kernel networking stack. Exact CPE and affected kernel version ranges have not been confirmed in available data.
Affected ProductsAI
The affected product is the Linux kernel, specifically the ICMPv6/NDP receive path (rx_ndp_ns). The vulnerability was reported by Ubuntu, suggesting it affects kernel versions shipped or supported by Ubuntu distributions. Exact upstream version ranges, CPE strings, and the first-affected / fixed-in commit have not been confirmed in the available intelligence. Operators running any Linux distribution with IPv6 enabled should monitor their distribution's security advisory channels for kernel updates addressing this issue.
RemediationAI
Patch available per vendor advisory (Ubuntu); however, an exact fixed kernel version has not been independently confirmed in the available data - monitor Ubuntu Security Notices (USN) and the upstream Linux kernel stable queue for the specific commit addressing rx_ndp_ns length validation. As a compensating control prior to patching, operators who do not require IPv6 on affected interfaces can disable IPv6 on those interfaces using sysctl net.ipv6.conf.<interface>.disable_ipv6=1, which eliminates the attack surface entirely at the cost of IPv6 connectivity. If IPv6 is operationally required, restricting ICMPv6 traffic at the perimeter or VLAN boundary using firewall rules (ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-solicitation -j DROP from untrusted segments) can limit exposure to trusted network segments; note this may interfere with legitimate NDP operations and should be tested carefully before production deployment.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today