What is the CVSS score of CVE-2026-64116?

CVE-2026-64116 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64116?

Linux systems running vulnerable kernel versions face remote denial-of-service crashes triggered by crafted IPv6 packets, creating risk of unexpected service disruptions across internet-facing…. A patch is available.

How to fix or mitigate CVE-2026-64116?

Within 24 hours, scan infrastructure to identify Linux systems running vulnerable kernel versions and notify affected teams. Within 7 days, test available kernel patches on staging systems to verify stability and compatibility with running services. Within 30 days, schedule and execute kernel updates on production systems with appropriate maintenance windows, prioritizing internet-facing and business-critical systems.

Linux Kernel CVE-2026-64116

EUVD-2026-45801 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-19 Linux

GHSA-6p6q-g32r-gx25

Linux Denial Of Service Null Pointer Dereference

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it needs non-default IOAM enabled plus a narrow RCU teardown race; only a crash, so A:H with C:N/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:33 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Reported by Sashiko:

The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option.

Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.

AnalysisAI

Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.

Technical ContextAI

The affected code is in the kernel's IPv6 Hop-by-Hop options handler, specifically ipv6_hop_ioam() in net/ipv6/exthdrs.c, which parses IOAM (In-situ Operations, Administration and Maintenance, RFC 9197) trace option data attached to inbound IPv6 packets. To decide whether IOAM is enabled on the receiving interface it calls __in6_dev_get(skb->dev) to obtain the per-device inet6_dev structure and reads cnf.ioam6_enabled. Per CPE data (cpe:2.3:a:linux:linux) the affected component is the upstream Linux kernel networking stack across the 5.15 through 7.x series. The root cause is CWE-476 (NULL Pointer Dereference): __in6_dev_get() performs an RCU-protected lookup that legitimately returns NULL when addrconf_ifdown() has cleared dev->ip6_ptr during interface teardown, and the code failed to validate this before dereferencing. The fix adds a NULL check and drops the packet with SKB_DROP_REASON_IPV6DISABLED.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.210, 6.1.176, 6.6.143, 6.12.92, 6.18.34, 7.0.11, or 7.1 or later on the matching branch - using your distribution's kernel package once it incorporates the upstream stable commits listed at git.kernel.org/stable/c/ (for example cf75eb6617042c8cff6112daeed7791809fc9dd2 and c7e8971abd70e9d022f1c251ba2508f8dc7f2db8). As an immediate compensating control where patching must wait, disable IOAM on all interfaces by ensuring net.ipv6.ioam6_enabled (and per-interface ioam6_enabled) is 0, which is the default and removes the vulnerable code path entirely at the cost of losing IOAM telemetry; alternatively drop inbound IPv6 packets carrying Hop-by-Hop IOAM options at an upstream firewall, with the trade-off of blocking any legitimate IOAM measurement traffic. Verify fixes via the advisory URLs in the references, notably https://nvd.nist.gov/vuln/detail/CVE-2026-64116.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64116 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64116

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code