netfilter: ip6t_rpfilter: reject routes without inet6_dev

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98379
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-09 08:16:56 UTC
Updated2026-10-19 10:18:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects in the FIB. An unprivileged user can construct this state with rtnetlink in a private user and network namespace, then trigger a NULL dereference through an IPv6 rpfilter lookup: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) Call Trace: ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316) nf_hook_slow (net/netfilter/core.c:619) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6216) process_backlog (net/core/dev.c:6680) __napi_poll (net/core/dev.c:7739) net_rx_action (net/core/dev.c:7959) handle_softirqs (kernel/softirq.c:622) do_softirq.part.0 (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:450) __dev_queue_xmit (net/core/dev.c:4913) packet_sendmsg (net/packet/af_packet.c:3139) __sys_sendto (net/socket.c:2252) __x64_sys_sendto (net/socket.c:2259) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Reject routes without an inet6_dev immediately after lookup. Such routes are not eligible for reverse-path filtering, and the check protects all later rt6i_idev dereferences.

Risk And Classification

EPSS: 0.001640000 probability, percentile 0.051700000 (date 2026-10-11)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 f4de78756b0fddbd125b2b1b77c74f2eccc8e977 git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 1681ab6dd1271f2f36047490793b78b1848bbcc9 git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 65487e9e99431ffcf05024a817f51ee4e3bd9b47 git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 f49da48bd679cfee646d6a40dd02b1933de577d1 git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40 git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 eafe081ea77d25b5c8e601680671b4ecb4520e7d git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 3a7384bc2e66217c9a01a392281334f4423740a0 git Not specified
CNA Linux Linux affected e26f9a480fb6c1b614660e824d69a74e2ce990f3 1b9b5323725e458906c7620a3bc10398b51ad954 git Not specified
CNA Linux Linux affected 3.3 Not specified
CNA Linux Linux unaffected 3.3 semver Not specified
CNA Linux Linux unaffected 5.10.271 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.55 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.9 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/f4de78756b0fddbd125b2b1b77c74f2eccc8e977 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/65487e9e99431ffcf05024a817f51ee4e3bd9b47 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1b9b5323725e458906c7620a3bc10398b51ad954 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1681ab6dd1271f2f36047490793b78b1848bbcc9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f49da48bd679cfee646d6a40dd02b1933de577d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/eafe081ea77d25b5c8e601680671b4ecb4520e7d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3a7384bc2e66217c9a01a392281334f4423740a0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report