Cloudanix VulnDB

CVE-2026-98379

None

CVSS

—

EPSS

0.2%

Published

Oct 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's IPv6 packet filtering can let a regular user crash the entire system by sending certain network packets.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in ip6t_rpfilter during IPv6 route lookup when rt6i_idev is absent after ip6_route_lookup succeeds, triggered by MTU-induced inet6_dev teardown combined with FIB routes using nexthop objects.

Why it matters to the business

Unprivileged local users can crash affected Linux systems, causing denial of service and potential loss of availability for network services and workloads.

How an attack unfolds

An attacker creates a private user and network namespace, uses rtnetlink to configure routes that survive inet6_dev teardown on an external nexthop, then sends IPv6 packets that invoke rpfilter, dereferencing the NULL rt6i_idev and triggering a kernel panic.

How to fix it

Update to a Linux kernel containing the fix that rejects routes lacking inet6_dev immediately after ip6_route_lookup in ip6t_rpfilter. Reboot required after kernel upgrade.

How to confirm the fix worked

Confirm kernel version includes the commit rejecting routes without inet6_dev; test by reproducing the MTU and namespace setup in a lab environment and verifying no crash occurs on rpfilter invocation.

Typical attack path

  1. Create private user and network namespace
  2. Lower MTU of external nexthop device below IPV6_MIN_MTU to tear down inet6_dev
  3. Use rtnetlink to install FIB routes referencing nexthop objects
  4. Send crafted IPv6 packets that trigger ip6t_rpfilter lookup
  5. Trigger NULL dereference and kernel panic

How to detect it

Review kernel logs for general protection faults or null-ptr-deref in rpfilter_mt, ip6t_do_table, or related IPv6 netfilter paths; correlate with unusual namespace or rtnetlink activity preceding the crash.

What your security team should do

  • Prioritize kernel updates on systems using IPv6 rpfilter rules
  • Restrict unprivileged namespace creation via kernel parameters or seccomp if immediate patching is delayed
  • Monitor for kernel oops and panic logs related to ip6t_rpfilter

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects in the FIB. An unprivileged user can construct this state with rtnetlink in a private user and network namespace, then trigger a NULL dereference through an IPv6 rpfilter lookup: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) Call Trace: ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316) nf_hook_slow (net/netfilter/core.c:619) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6216) process_backlog (net/core/dev.c:6680) __napi_poll (net/core/dev.c:7739) net_rx_action (net/core/dev.c:7959) handle_softirqs (kernel/softirq.c:622) do_softirq.part.0 (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:450) __dev_queue_xmit (net/core/dev.c:4913) packet_sendmsg (net/packet/af_packet.c:3139) __sys_sendto (net/socket.c:2252) __x64_sys_sendto (net/socket.c:2259) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Reject routes without an inet6_dev immediately after lookup. Such routes are not eligible for reverse-path filtering, and the check protects all later rt6i_idev dereferences.

Affected packages

Ecosystem Package Introduced Fixed