Cloudanix VulnDB

CVE-2026-23442

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Apr 3, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can let a logged-in user crash the whole computer by sending certain network messages when IPv6 is not fully set up on an interface.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing NULL checks on the result of __in6_dev_get() inside seg6_hmac_validate_skb() and ipv6_srh_rcv() allow a local user to trigger a NULL pointer dereference when an interface lacks IPv6 configuration, resulting in a kernel crash.

Why it matters to the business

Linux systems that process SRv6 traffic or expose IPv6 interfaces to untrusted local users may experience unexpected kernel panics and service outages; the low EPSS and absence from KEV indicate limited active exploitation risk at present.

How an attack unfolds

An attacker with local access configures an interface without IPv6 or forces NETDEV_UNREGISTER, then sends an SRv6 packet that reaches the two functions so that the unchecked idev pointer is dereferenced, crashing the kernel.

How to fix it

Apply the upstream kernel commit that adds the missing NULL checks for idev in both functions; monitor your distribution for a backported fix and reboot after installing the updated kernel package.

How to confirm the fix worked

Verify the presence of the explicit NULL checks on the return value of __in6_dev_get() inside seg6_hmac_validate_skb() and ipv6_srh_rcv(); confirm that a system with an IPv6-disabled interface no longer panics when the SRv6 paths are exercised.

Typical attack path

  1. Obtain local shell or user context on the target Linux system
  2. Create or manipulate a network interface that has no IPv6 configuration or trigger device unregister events
  3. Send a crafted IPv6 Segment Routing packet that exercises seg6_hmac_validate_skb or ipv6_srh_rcv
  4. Trigger the NULL dereference and cause a kernel panic

How to detect it

Search kernel logs for NULL pointer dereference oops messages originating from the IPv6 SRv6 code paths; correlate with recent interface configuration changes or SRv6 packet reception.

What your security team should do

  • Prioritize kernel updates on systems that handle SRv6 or expose IPv6 interfaces to local users
  • Review local attack surface by identifying processes that can create or unregister network interfaces
  • Monitor EPSS trend and KEV status for any future increase in exploit activity

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities