CVE-2026-89561

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) implementation. A remote attacker could send specially crafted IPv6 packets to a vulnerable system while manipulating the network interface's Maximum Transmission Unit (MTU), which defines the largest packet size that can be transmitted. This manipulation could lead to a null pointer dereference in the ipv6_rpl_srh_rcv() function, causing a kernel crash and resulting in a Denial of Service (DoS).

A MODERATE severity flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) Segment Routing Header processing, affecting the kernel in Red Hat Enterprise Linux 9 and 10 and the RHEL CoreOS 9 based OpenShift Container Platform 4 and 5 releases. When a network interface's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr, and an IPv6 packet that already passed the idev check in ip6_rcv_core() can reach ipv6_rpl_srh_rcv() with a NULL idev pointer, causing a kernel panic and denial of service. Triggering the flaw requires a race between the arrival of crafted IPv6 packets carrying a routing header and the interface MTU being lowered below the IPv6 minimum, an operation that requires privileged local access to the system; for this reason Red Hat rates this flaw MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L) rather than the upstream IMPORTANT rating (CVSS 3.1 score 7.5, AV:N/PR:N), which assumes no privileges are required. Red Hat Enterprise Linux 7 and 8 and the OpenShift Container Platform 4.12 stream shipping RHEL CoreOS 8 are not affected because the vulnerable code is not present in their kernels. For the affected products the fix is deferred: the flaw is MODERATE severity with a CVSS 3.1 score below 7.0, and Red Hat does not file updates for kernel flaws of this severity without a higher CVSS score. The residual risk is a system crash (denial of service) on affected hosts when a user with privileges to change an interface MTU lowers it below IPV6_MIN_MTU while IPv6 routing-header traffic is being received.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.