CVE-2026-64569

A flaw was found in the Linux kernel's Multiprotocol Label Switching (MPLS) subsystem. An unprivileged local user could send a specially crafted network message, leading to a null pointer dereference. This vulnerability could cause a system crash, resulting in a denial of service.

A flaw of moderate severity was found in the Linux kernel's MPLS subsystem, affecting Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2. On kernels built with CONFIG_INET disabled, mpls_valid_fib_dump_req() walks the parsed netlink attribute table itself instead of calling ip_valid_fib_dump_req(), and its RTA_OIF code path passes tb[RTA_OIF] to nla_get_u32() without first checking that the attribute is present. An unprivileged local user can exploit this by sending an RTM_GETROUTE dump request for AF_MPLS with strict checking enabled and without an RTA_OIF attribute, an operation that rtnetlink permits without CAP_NET_ADMIN. The result is a NULL pointer dereference that crashes the kernel, causing a denial of service. Kernel builds with CONFIG_INET enabled are not exposed to this code path because they use ip_valid_fib_dump_req(), which skips unset attributes. Red Hat Enterprise Linux 6 and 7 are listed as not affected because the vulnerable code is not present in those streams. Because the vulnerable path is limited to kernels built with CONFIG_INET disabled, the fix for the affected streams has been deferred to a future update; the residual risk is that an unprivileged local user could trigger a kernel crash and denial of service, but only on such CONFIG_INET=n builds, and there is no impact on confidentiality or integrity. The Red Hat severity of moderate with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects the local, low-privilege attack vector with availability-only impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.