CVE-2026-23304

What it actually does

NULL pointer dereference in ip6_rt_get_dev_rcu during IPv6 route allocation when l3mdev_master_dev_rcu returns NULL on VRF slave device removal, leading to kernel crash via KASAN null-ptr-deref.

Why it matters to the business

Local users or processes can trigger system crashes and denial of service on Linux hosts using IPv6 with VRF configurations, causing unplanned downtime and potential loss of network connectivity.

How an attack unfolds

An attacker with local access manipulates VRF device un-slaving while concurrent IPv6 routing lookups occur through fib6_rule_lookup and ip6_route_output_flags, hitting the missing loopback fallback in ip6_rt_pcpu_alloc and dereferencing a NULL device pointer.

How to fix it

Apply the upstream fix for the NULL dereference in IPv6 route device handling and rebuild or update to a patched kernel release; avoid un-slaving operations without the fallback path until updated.

How to confirm the fix worked

Inspect kernel logs for absence of KASAN null-ptr-deref in ip6_rt_pcpu_alloc after applying updates; verify the loopback fallback logic is present in net/ipv6/route.c and test VRF un-slaving under IPv6 load.

Typical attack path

1. Obtain local code execution or shell access
2. Configure or trigger VRF slave device removal
3. Perform concurrent IPv6 route output operations
4. Trigger NULL dereference in route cache allocation
5. Cause kernel panic or system hang

How to detect it

Search kernel logs, dmesg, and systemd journal for KASAN null-ptr-deref messages referencing ip6_rt_pcpu_alloc, ip6_pol_route, or vrf_process_v6_outbound around times of VRF configuration changes.

• KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
• RIP: ip6_rt_pcpu_alloc
• Call Trace: ip6_pol_route fib6_rule_lookup ip6_route_output_flags vrf_process_v6_outbound

What your security team should do

• Prioritize kernel updates for systems using IPv6 and VRF
• Restrict local unprivileged access to network configuration interfaces
• Monitor kernel oops and panic logs for IPv6 route functions
• Test patched kernels in staging environments before production rollout