Not yet scoredPublished Aug 10, 2026

CVE-2026-68336bonding: fix devconf_all NULL dereference when IPv6 is disabled

Updated under an hour ago (Oct 26, 2026, 7:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconf_all NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route(). BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by adding ipv6_mod_enabled() condition check in the caller.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 451c2d5422a309393aa8ae161fc1a527c2f19ab2; 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 builds before 2a4bad24ac5296b262ad821aa5e08bb265e6b154; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 690ce66782778e8c4b1fdd79c0b0890a100e9522; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 992dce02bdabbd9883255ea9b36494e34a7821d7; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038; 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 builds before 1c975de3343cdef506f2eecc833cc1f14b0401c4	CNA record

References

References

https://git.kernel.org/stable/c/451c2d5422a309393aa8ae161fc1a527c2f19ab2
https://git.kernel.org/stable/c/2a4bad24ac5296b262ad821aa5e08bb265e6b154
https://git.kernel.org/stable/c/690ce66782778e8c4b1fdd79c0b0890a100e9522
https://git.kernel.org/stable/c/992dce02bdabbd9883255ea9b36494e34a7821d7
https://git.kernel.org/stable/c/738039ad21e20ca2c5bbde2f5a4f5ad5fb718038
https://git.kernel.org/stable/c/1c975de3343cdef506f2eecc833cc1f14b0401c4

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.