Not yet scoredPublished Aug 5, 2026

CVE-2026-64569mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

Updated under an hour ago (Oct 26, 2026, 1:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 196cfebf897266c3450519e916bab9daff74e52c before bfc1cb5d6a8308e493e307f1c823d2107abc0a47; 196cfebf897266c3450519e916bab9daff74e52c builds before 03b5a2c29afc8e634924c75d6ee94140e70de88d; from 196cfebf897266c3450519e916bab9daff74e52c before e796ce9ef4356dc7cbbaa8373843f77852f2814d; from 196cfebf897266c3450519e916bab9daff74e52c before d6eee7cd078aaf9dd75efc801f6c9b608a37cd71; from 196cfebf897266c3450519e916bab9daff74e52c before ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce; 196cfebf897266c3450519e916bab9daff74e52c builds before 5f6e7b32bd1fbde10fd31a4143260735ea535b8a; 196cfebf897266c3450519e916bab9daff74e52c builds before 06db79411a280707c7e4bf4b221ff4e664b51502; 196cfebf897266c3450519e916bab9daff74e52c builds before 56d96fededd61192cd7cc8d2b0f36adfd59036c3	CNA record

References

References

https://git.kernel.org/stable/c/bfc1cb5d6a8308e493e307f1c823d2107abc0a47
https://git.kernel.org/stable/c/03b5a2c29afc8e634924c75d6ee94140e70de88d
https://git.kernel.org/stable/c/e796ce9ef4356dc7cbbaa8373843f77852f2814d
https://git.kernel.org/stable/c/d6eee7cd078aaf9dd75efc801f6c9b608a37cd71
https://git.kernel.org/stable/c/ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce
https://git.kernel.org/stable/c/5f6e7b32bd1fbde10fd31a4143260735ea535b8a
https://git.kernel.org/stable/c/06db79411a280707c7e4bf4b221ff4e664b51502
https://git.kernel.org/stable/c/56d96fededd61192cd7cc8d2b0f36adfd59036c3

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.