CVE-2026-80646

A flaw was found in the Linux kernel's IPv6 component. This vulnerability arises when the dev_get_by_index_rcu() function returns a null value if the original physical device is unregistered, leading to a NULL pointer dereference in __in6_dev_stats_get(). A local attacker could exploit this flaw to trigger a system crash, resulting in a Denial of Service (DoS).

A MODERATE-impact NULL pointer dereference flaw was found in the Linux kernel's IPv6 statistics path, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 as well as Red Hat In-Vehicle OS. In __in6_dev_stats_get(), the pointer returned by dev_get_by_index_rcu() is used without checking for NULL; when the original physical network device is unregistered, dev_get_by_index_rcu() returns NULL, causing a kernel panic. A local attacker able to trigger this condition could crash the system, resulting in a denial of service; there is no impact to confidentiality or integrity. Red Hat Enterprise Linux 7 and 8 are not affected because the vulnerable code is not present in those releases, and the assessment for Red Hat Enterprise Linux 6 Extended Lifecycle Support is still in progress. The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS streams is currently deferred, so the vulnerable code remains in shipped kernels; the residual risk is limited to local denial of service. The upstream CVE record assigns a CVSS 3.1 score of 7.5 (Important) with a network attack vector, while Red Hat rates this flaw 5.5 (Moderate) with a local attack vector and low privileges required, reflecting that triggering the crash requires local access on the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.