CVE-2026-64538

A flaw was found in the Linux kernel's IPv6 networking component. A null pointer dereference vulnerability exists in the fib6_nh_mtu_change() function. This can occur when the idev (in6_device) pointer is cleared during network interface shutdown, but the fib6_nh_mtu_change() function attempts to dereference it without a proper null check. An attacker could potentially trigger this condition, leading to a kernel crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel IPv6 routing implementation. The fib6_nh_mtu_change() function re-fetches the associated inet6_dev (idev) pointer via __in6_dev_get() and dereferences idev->cnf.mtu6 without a NULL check. When a network interface is brought down, addrconf_ifdown() clears the device IPv6 pointer (dev->ip6_ptr) while nexthop-backed routes can still reference the interface during the teardown window. If an incoming ICMPv6 Router Advertisement drives an MTU update on one of these routes, via icmpv6_rcv(), ndisc_router_discovery(), and rt6_mtu_change(), while the interface teardown race is in progress, fib6_nh_mtu_change() can observe a NULL idev and crash. This is classified as CWE-476 (NULL Pointer Dereference) and results in a kernel oops or crash, a denial of service only. There is no confidentiality or integrity impact, since the fault occurs on a NULL pointer read with no further data exposure or corruption. Triggering the flaw requires an attacker on the same local network segment (adjacent) sending ICMPv6 Router Advertisement traffic while the target interface happens to be undergoing teardown, a timing condition outside the attacker's control. Fixed upstream in the Linux kernel via commit 46c3b8191aad3d032776bf3bebf03efdf5f4b905.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation for this issue other than applying the fix. Exploitation requires an attacker on the same local network segment as the target, and requires a network interface carrying nexthop-backed IPv6 routes to be undergoing teardown at the same time an ICMPv6 Router Advertisement is processed against it, a race window that is not reliably controllable by an attacker.