EUVD-2026-76472
GHSA-cq7m-m9w3-cxf7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Race condition requires concurrent MTU change on target interface, raising AC to H; impact is DoS-only with no confidentiality or integrity effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled.
When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL.
Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200:
BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394
CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: <IRQ> kasan_report+0xc6/0x100 ipv6_rpl_srh_rcv+0xb3/0x1070 ip6_protocol_deliver_rcu+0x759/0x9a0 ip6_input_finish+0xa8/0x1b0 ip6_input+0xe1/0x490 ipv6_rcv+0x33d/0x460 __netif_receive_skb_one_core+0xd6/0x130 process_backlog+0x2cc/0xa00 __napi_poll.constprop.0+0x56/0x270 net_rx_action+0x327/0x730 handle_softirqs+0x11e/0x630 do_softirq+0xb3/0xf0 </IRQ>
Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from ipv6_rthdr_rcv(), which already has an idev lookup.
Fix the NULL dereference on the RPL path by checking idev in ipv6_rthdr_rcv(), before it calls either function. The callees take idev as an argument and no longer call __in6_dev_get(), so the packet is now dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
AnalysisAI
NULL pointer dereference in the Linux kernel's IPv6 RPL source routing header handler (ipv6_rpl_srh_rcv()) enables a remote unauthenticated attacker to crash the kernel by delivering IPv6 RPL-header packets during a concurrent MTU-drop event on the receiving interface. The race exists because idev obtained from __in6_dev_get() is used without a NULL guard - addrconf_ifdown() can clear dev->ip6_ptr via RCU_INIT_POINTER() between the time ip6_rcv_core() validates idev and the time ipv6_rpl_srh_rcv() dereferences idev->cnf.rpl_seg_enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target kernel includes RPL source routing support compiled in (CONFIG_IPV6_RPL_LWTUNNEL or equivalent, present since Linux 5.7) - this is not the default in most general-purpose distribution kernels and is most common in IoT/6LoWPAN or embedded Linux deployments; (2) the receiving network interface undergoes an MTU change that crosses the IPV6_MIN_MTU (1280-byte) threshold during the attack, which either requires local/administrative access to the target's network interface or influence over path-MTU via crafted ICMPv6 Packet Too Big messages; and (3) IPv6 RPL routing-header packets must reach the host during the narrow race window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly captures network reachability and the DoS-only impact, but AC:L is optimistic - reliably triggering the race requires timed concurrency between an MTU oscillation below 1280 bytes on the target interface and an in-flight IPv6 RPL packet stream, which is AC:H in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 7.2.4, 6.18.50, or 7.3-rc1, which contain the fix that moves the idev NULL check into `ipv6_rthdr_rcv()` before dispatching to either the RPL or SRH handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Linux systems with IPv6 enabled and RPL routing support in your inventory, particularly cloud infrastructure and public-facing services; for systems unable to patch immediately, evaluate disabling RPL routing if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today