Not yet scoredPublished Jul 27, 2026

CVE-2026-64542ipv6: ndisc: fix NULL deref in accept_untracked_na()

Updated under an hour ago (Oct 27, 2026, 12:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check, even though its only caller ndisc_recv_na() already fetched and NULL-checked idev for the same device. Both reads of dev->ip6_ptr run in the same RCU read-side critical section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchronize_net() that orders the unregister path, so the re-fetch returns NULL and oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974) Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndisc_recv_na (net/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_input.c:534) ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_input.c:635) ipv6_rcv (net/ipv6/ip6_input.c:351) </IRQ> It is reachable by an unprivileged user via a network namespace. Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev->ip6_ptr has been cleared.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 before e5ba3017e46f275ad347e762e8eecacec5efa41d; from aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 before 160d3f0d7a556ceae505dcab521a37057b4ce28f; from aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 before 62c719203cb521b64fab74da94a81bdde5c18808; from aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 before a6450f7cfae57b382cbaf66a577765c9a88b3c58; from aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 before 63d1c23764de2309cedbb779c75188d257a09d9b; from aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 before d186e942365acece7c56d39da05dd63bf95b280a	CNA record

References

References

https://git.kernel.org/stable/c/e5ba3017e46f275ad347e762e8eecacec5efa41d
https://git.kernel.org/stable/c/160d3f0d7a556ceae505dcab521a37057b4ce28f
https://git.kernel.org/stable/c/62c719203cb521b64fab74da94a81bdde5c18808
https://git.kernel.org/stable/c/a6450f7cfae57b382cbaf66a577765c9a88b3c58
https://git.kernel.org/stable/c/63d1c23764de2309cedbb779c75188d257a09d9b
https://git.kernel.org/stable/c/d186e942365acece7c56d39da05dd63bf95b280a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.