Skip to main content

Linux Kernel CVE-2026-53012

| EUVDEUVD-2026-38880 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-g5vp-298m-r34q
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with CAP_NET_ADMIN required; attack sequence is deterministic with no timing dependency; impact is kernel panic only, with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:51 vuln.today
CVSS changed
Jul 14, 2026 - 17:52 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nexthop: fix IPv6 route referencing IPv4 nexthop

syzbot reported a panic [1] [2].

When an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag of all groups containing this nexthop is not updated. This is because nh_group_v4_update is only called when replacing AF_INET to AF_INET6, but the reverse direction (AF_INET6 to AF_INET) is missed.

This allows a stale has_v4=false to bypass fib6_check_nexthop, causing IPv6 routes to be attached to groups that effectively contain only AF_INET members. Subsequent route lookups then call nexthop_fib6_nh() which returns NULL for the AF_INET member, leading to a NULL pointer dereference.

Fix by calling nh_group_v4_update whenever the family changes, not just AF_INET to AF_INET6.

Reproducer:

AF_INET6 blackhole

ip -6 nexthop add id 1 blackhole

group with has_v4=false

ip nexthop add id 100 group 1

replace with AF_INET (no -6), has_v4 stays false

ip nexthop replace id 1 blackhole

pass stale has_v4 check

ip -6 route add 2001:db8::/64 nhid 100

panic

ping -6 2001:db8::1

[1] https://syzkaller.appspot.com/bug?id=e17283eb2f8dcf3dd9b47fe6f67a95f71faadad0 [2] https://syzkaller.appspot.com/bug?id=8699b6ae54c9f35837d925686208402949e12ef3

AnalysisAI

NULL pointer dereference in the Linux kernel nexthop routing subsystem allows a local privileged attacker to crash the kernel (denial of service) by exploiting a stale address-family flag state. The has_v4 flag in nexthop groups is not updated when an IPv6 nexthop is replaced with an IPv4 one, letting a corrupt group bypass fib6_check_nexthop validation and attach to an IPv6 route; subsequent traffic through that route calls nexthop_fib6_nh(), which returns NULL for the AF_INET member, triggering the panic. No public exploit identified at time of analysis, though the CVE disclosure itself includes a functional step-by-step reproducer using standard ip nexthop and ip route commands, and the EPSS score of 0.18% (8th percentile) reflects low current real-world exploitation pressure.

Technical ContextAI

The Linux kernel nexthop subsystem (net/ipv4/nexthop.c), introduced in kernel 5.3, manages shared next-hop routing objects usable by both IPv4 and IPv6 routing tables. The has_v4 boolean flag on a nexthop group tracks whether any member is AF_INET and gates the fib6_check_nexthop() validation path for IPv6 route attachment. The bug is a logic gap: nh_group_v4_update() was only invoked on AF_INET→AF_INET6 family transitions, leaving the reverse direction (AF_INET6→AF_INET) unhandled. A stale has_v4=false allows an IPv6 route to be attached to a group whose member is effectively AF_INET. During packet forwarding, nexthop_fib6_nh() is called on that AF_INET member and returns NULL, which is then dereferenced - a textbook CWE-476 (NULL Pointer Dereference). CPE data identifies the affected product as cpe:2.3:a:linux:linux across multiple stable branches beginning at commit 7bf4796dd09984ad1612877a82d0d139c70ae27f (kernel 5.3).

RemediationAI

The primary remediation is to upgrade to a patched stable kernel version: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 or later. Upstream fix commits are available at https://git.kernel.org/stable/c/ceffe81a0be92afc0cd1340bc8ca46559cce9bb4 and sibling commits (9c2d6770, 6275796f, aaac3bed, ad859610, 613c8f4a, b3b7e850, 29c95185) covering all maintained stable branches. Ubuntu users should apply the applicable USN advisory for their release. As a compensating control where patching is not immediately possible, restrict CAP_NET_ADMIN to only trusted system processes and root; in particular, audit Kubernetes pod security policies and container runtimes to ensure CAP_NET_ADMIN is not granted to untrusted workloads, as this capability alone enables exploitation within a user namespace. Note that restricting CAP_NET_ADMIN will prevent legitimate in-container network configuration (CNI plugins, VPN clients, custom routing tools) and should be paired with namespace-level network policy to avoid breaking workloads that rely on it.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53012 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy