CVE-2026-23381

A flaw was found in the Linux kernel's network bridging component. When Internet Protocol version 6 (IPv6) is explicitly disabled, a critical data structure for Neighbor Discovery is not properly initialized. A remote attacker could exploit this by sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Neighbor Discovery packet. This could lead to a kernel NULL pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).

This flaw affects bridge configurations with neigh_suppress enabled while IPv6 is disabled via ipv6.disable=1. When ICMPv6 ND packets reach the bridge, br_do_suppress_nd() dereferences the uninitialized nd_tbl, causing a NULL pointer crash. Similar to CVE-2026-23293 but affects bridge instead of VXLAN.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use the ipv6.disable=1 boot parameter on systems using network bridging with neighbor suppression, or disable neigh_suppress on bridges when IPv6 is disabled.