CVE-2026-23442

MEDIUM

ipv6: add NULL checks for idev in SRv6 paths

Title source: cna
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences.

Scores

CVSS v3 5.5
EPSS 0.0012
EPSS Percentile 2.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (29)
linux/Kernel 4.10.0 - 5.10.258linux
linux/Kernel 5.11.0 - 5.15.209linux
linux/Kernel 5.16.0 - 6.1.175linux
linux/Kernel 6.13.0 - 6.18.25linux
linux/Kernel 6.19.0 - 6.19.10linux
linux/Kernel 6.2.0 - 6.6.136linux
linux/Kernel 6.7.0 - 6.12.83linux
Linux/Linux < 4.10
Linux/Linux 1ababeba4a21f3dba3da3523c670b207fb2feb62 - 0348fa0ada37cef7c6b5ab2a428bb2c6aee784e4
Linux/Linux 1ababeba4a21f3dba3da3523c670b207fb2feb62 - 06413793526251870e20402c39930804f14d59c0
... and 19 more
Published Apr 03, 2026
Tracked Since Apr 03, 2026