Medium 5.5Published Mar 25, 2026

CVE-2026-23304ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

Updated under an hour ago (Oct 27, 2026, 11:30 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4832c30d5458387ff2533ff66fbde26ad8bb5a2d before d542e2ac7f9e288d49735be0775611547ca4e0ee; from 4832c30d5458387ff2533ff66fbde26ad8bb5a2d before a73fe9f4ae84a239d5b2686f47a58c158aee2eb4; 4832c30d5458387ff2533ff66fbde26ad8bb5a2d builds before 4a48fe59f29f673a3d042d679f26629a9c3e29d4; from 4832c30d5458387ff2533ff66fbde26ad8bb5a2d before 581800298313c9fd75e94985e6d37d21b7e35d34; 4832c30d5458387ff2533ff66fbde26ad8bb5a2d builds before 3310fc11fc47387d1dd4759b0bc961643ea11c7f; 4832c30d5458387ff2533ff66fbde26ad8bb5a2d builds before 0b5a7826020706057cc5a9d9009e667027f221ee; from 4832c30d5458387ff2533ff66fbde26ad8bb5a2d before ae88c8256547b63980770a9ea7be73a15900d27e; 4832c30d5458387ff2533ff66fbde26ad8bb5a2d builds before 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.14 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d542e2ac7f9e288d49735be0775611547ca4e0ee	patch
https://git.kernel.org/stable/c/a73fe9f4ae84a239d5b2686f47a58c158aee2eb4	patch
https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4	patch
https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34	patch
https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f	patch
https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee	patch
https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e	patch
https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.