CVE-2026-23293

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) module. When IPv6 is disabled, a remote attacker can trigger a system crash by injecting a specially crafted IPv6 packet into the network interface. This vulnerability, a null pointer dereference, can lead to a denial of service.

This flaw affects systems using VXLAN while IPv6 is explicitly disabled via the ipv6.disable=1 boot parameter. When an IPv6 packet reaches the VXLAN interface under these conditions, the uninitialized nd_tbl causes a NULL pointer dereference. This configuration (VXLAN with IPv6 disabled) is uncommon but could be present in specialized network deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use the ipv6.disable=1 boot parameter on systems using VXLAN, or avoid VXLAN when IPv6 is disabled.