CVE-2026-80646

What it actually does

Missing NULL check on return value from dev_get_by_index_rcu() allows dereference of a NULL pointer inside __in6_dev_stats_get() when an IPv6 device is unregistered concurrently.

Why it matters to the business

Linux systems can experience unexpected kernel crashes or panics during routine IPv6 network statistics collection, causing service outages and requiring manual restarts or reboots.

How an attack unfolds

An attacker triggers concurrent device unregistration (for example by removing a network interface or triggering hot-unplug) while the kernel path that calls __in6_dev_stats_get() is executing, causing the function to dereference a NULL pointer and crash the system.

How to fix it

Apply the upstream kernel patch that adds the missing NULL guard in __in6_dev_stats_get(); rebuild and deploy updated kernels to all affected Linux distributions.

How to confirm the fix worked

Confirm the patch is present by inspecting the source of __in6_dev_stats_get() for the added NULL check after dev_get_by_index_rcu(); test by exercising interface removal under load.

Typical attack path

1. Identify a Linux host exposing IPv6 interfaces
2. Trigger or race device unregistration while IPv6 stats are collected
3. Cause NULL dereference leading to kernel panic and denial of service

How to detect it

Review kernel logs for oops or panic messages referencing __in6_dev_stats_get or ipv6 stats collection around the time of interface removal events.

What your security team should do

• Prioritize kernel updates on all production Linux systems that use IPv6
• Monitor vendor advisories for distribution-specific backports
• Test updated kernels in staging before broad deployment