CVE-2026-23300

A flaw was found in the Linux kernel's IPv6 networking stack. When a standalone IPv6 nexthop object is created with a loopback device, it is misclassified as a reject route, leading to an unallocated pointer. If an IPv4 route then attempts to reference this nexthop, it causes a NULL pointer dereference. This can result in a kernel panic, leading to a denial of service (DoS) for the system.

This flaw affects systems using advanced routing features with IPv6 nexthop objects on loopback devices. The misclassification causes nhc_pcpu_rth_output to remain unallocated, leading to a panic when IPv4 routes reference the nexthop. Triggering this requires specific routing configuration with nexthop objects on loopback, which is uncommon in typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.