Medium 5.5Published Mar 25, 2026

CVE-2026-23300net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop

Updated under an hour ago (Oct 28, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies it as a reject route. This is because nexthop objects have no destination prefix (fc_dst=::), causing fib6_is_reject() to match any loopback nexthop. The reject path skips fib_nh_common_init(), leaving nhc_pcpu_rth_output unallocated. If an IPv4 route later references this nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and panics. Simplify the check in fib6_nh_init() to only match explicit reject routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback promotion heuristic in fib6_is_reject() is handled separately by ip6_route_info_create_nh(). After this change, the three cases behave as follows: 1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"): RTF_REJECT is set, enters reject path, skips fib_nh_common_init(). No behavior change. 2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. ip6_route_info_create_nh() still promotes it to reject afterward. nhc_pcpu_rth_output is allocated but unused, which is harmless. 3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. nhc_pcpu_rth_output is properly allocated, fixing the crash when IPv4 routes reference this nexthop.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before 607e68c1b7c5a30c795571be1906d716e989a644; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before c11d7c56c2076ee9cd72004f1976fe0734df2ae9; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before b5062fc2150614c9ea8a611c2e0cb6e047ebfa3a; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before b299121e7453d23faddf464087dff513a495b4fc; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before f7c9f8e3607440fe39300efbaf46cf7b5eecb23f; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before b3b5a037d520afe3d5276e653bc0ff516bbda34c; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before 8650db85b4259d2885d2a80fbc2317ce24194133; 493ced1ac47c48bb86d9d4e8e87df8592be85a0e builds before 21ec92774d1536f71bdc90b0e3d052eff99cf093	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.3 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/607e68c1b7c5a30c795571be1906d716e989a644	patch
https://git.kernel.org/stable/c/c11d7c56c2076ee9cd72004f1976fe0734df2ae9	patch
https://git.kernel.org/stable/c/b5062fc2150614c9ea8a611c2e0cb6e047ebfa3a	patch
https://git.kernel.org/stable/c/b299121e7453d23faddf464087dff513a495b4fc	patch
https://git.kernel.org/stable/c/f7c9f8e3607440fe39300efbaf46cf7b5eecb23f	patch
https://git.kernel.org/stable/c/b3b5a037d520afe3d5276e653bc0ff516bbda34c	patch
https://git.kernel.org/stable/c/8650db85b4259d2885d2a80fbc2317ce24194133	patch
https://git.kernel.org/stable/c/21ec92774d1536f71bdc90b0e3d052eff99cf093	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.