Cloudanix VulnDB

CVE-2026-23439

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Apr 3, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

On certain Linux systems that do not use IPv6, a privileged network configuration action can accidentally crash the entire operating system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

When CONFIG_IPV6 is disabled, udp_sock_create6 returns success (0) without initializing the socket pointer; callers such as fou_create then dereference the NULL pointer, causing a kernel NULL dereference crash.

Why it matters to the business

Systems compiled without IPv6 support can experience kernel crashes triggered by privileged network tunnel configuration operations, leading to denial of service and potential loss of network services until reboot.

How an attack unfolds

A local user with privileges to send netlink messages invokes the FOU netlink handler; this calls udp_sock_create6 which silently succeeds without a socket; the handler then dereferences the uninitialized pointer, crashing the kernel.

How to fix it

Apply the upstream fix that changes udp_sock_create6 to return -EPFNOSUPPORT when IPv6 is disabled so callers take the proper error path; rebuild and deploy a kernel containing the resolution; consider enabling CONFIG_IPV6 if the feature is not intentionally disabled.

How to confirm the fix worked

Verify the kernel configuration used for builds, confirm the patched udp_sock_create6 implementation is present, and test FOU netlink operations both with and without CONFIG_IPV6 to ensure error paths are taken instead of crashes.

Typical attack path

  1. Obtain local access with CAP_NET_ADMIN or equivalent privileges
  2. Send a netlink genetlink message targeting the fou family add operation
  3. Invoke fou_nl_add_doit which calls udp_sock_create6 under CONFIG_IPV6=n
  4. Trigger NULL pointer dereference at fou_core.c:590/764 leading to kernel panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference crashes with RIP in fou_nl_add_doit or call traces containing fou_nl_add_doit, genl_family_rcv_msg_doit, and udp_sock_create6; correlate with netlink sendmsg activity from untrusted processes.

  • BUG: kernel NULL pointer dereference, address: 0000000000000018
  • RIP: fou_nl_add_doit (net/ipv4/fou_core.c:590
  • udp_sock_create6
  • fou_create

What your security team should do

  • Identify all kernels built with CONFIG_IPV6=n and prioritize patching those first
  • Monitor for kernel oops containing fou_nl_add_doit and udp_sock_create6 symbols
  • Restrict untrusted local access to netlink genetlink interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference the uninitialized socket pointer, resulting in a NULL pointer dereference. The captured NULL deref crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764) [...] Call Trace: <TASK> genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209) [...] netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1)) __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1)) __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130) This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so callers correctly take their error paths. There is only one caller of the vulnerable function and only privileged users can trigger it.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities