CVE-2026-23381: Linux Kernel Privilege Escalation Flaw

CVE-2026-23381 Overview

A NULL pointer dereference vulnerability exists in the Linux kernel's network bridge module when IPv6 is disabled. When the kernel is booted with the ipv6.disable=1 parameter, the nd_tbl (Neighbor Discovery table) is never initialized because inet6_init() exits before ndisc_init() is called. If neighbor suppression (neigh_suppress) is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, the br_do_suppress_nd() function will dereference ipv6_stub->nd_tbl which is NULL, passing it to neigh_lookup(). This results in a kernel NULL pointer dereference, causing a system crash.

Critical Impact

Systems running Linux kernel with IPv6 disabled and bridge neighbor suppression enabled are vulnerable to kernel panic when processing ICMPv6 Neighbor Discovery packets, leading to denial of service.

Affected Products

• Linux Kernel (multiple stable versions)
• Linux systems with network bridge module loaded
• Configurations using ipv6.disable=1 boot parameter with neigh_suppress enabled

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23381 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23381

Vulnerability Analysis

This vulnerability is classified as a Null Pointer Dereference that affects the Linux kernel's bridge networking subsystem. The issue stems from an improper initialization check when IPv6 functionality is disabled at boot time.

The vulnerability occurs in the network packet processing path, specifically within the bridge module's neighbor discovery suppression logic. When the kernel boots with IPv6 disabled (ipv6.disable=1), the initialization sequence is incomplete—inet6_init() returns early, preventing ndisc_init() from being called. As a result, the nd_tbl structure remains uninitialized (NULL).

During runtime, if bridge neighbor suppression is active and the system receives an ICMPv6 Neighbor Discovery packet, the br_do_suppress_nd() function attempts to perform a neighbor table lookup via neigh_lookup(). Since the code path uses IS_ENABLED(IPV6) (a compile-time check) rather than ipv6_mod_enabled() (a runtime check), it does not account for IPv6 being disabled at boot. This leads to dereferencing the NULL ipv6_stub->nd_tbl pointer at address 0x0000000000000268, triggering a kernel panic.

Root Cause

The root cause is the use of IS_ENABLED(IPV6) macro instead of ipv6_mod_enabled() function in the caller code paths. IS_ENABLED() is a compile-time check that evaluates whether IPv6 support was compiled into the kernel, but it cannot detect runtime disabling of IPv6 via boot parameters. The fix replaces this with ipv6_mod_enabled(), which properly checks whether IPv6 is actually available at runtime, effectively disabling NS/NA suppression when IPv6 is disabled.

Attack Vector

The attack vector involves sending ICMPv6 Neighbor Discovery packets to a target system running an affected Linux kernel configuration. The preconditions for exploitation are:

1. The target system must be running a vulnerable Linux kernel version
2. The kernel must be booted with ipv6.disable=1 parameter
3. The bridge module must be loaded with neigh_suppress feature enabled
4. An attacker must be able to send ICMPv6 Neighbor Discovery packets that reach the bridge interface

When these conditions are met, the kernel will crash upon processing the malicious packet, resulting in a denial of service. The crash occurs in the IRQ context during network packet processing, as shown by the kernel call trace originating from neigh_lookup() through br_do_suppress_nd() in the bridge module.

Detection Methods for CVE-2026-23381

Indicators of Compromise

• Kernel panic logs containing BUG: kernel NULL pointer dereference, address: 0000000000000268
• Crash dumps showing RIP: 0010:neigh_lookup+0x16/0xe0 in the call trace
• System crashes occurring during network traffic processing with bridge interfaces
• Oops messages referencing br_do_suppress_nd or br_handle_frame_finish in the bridge module

Detection Strategies

• Monitor kernel logs for NULL pointer dereference errors associated with the bridge module
• Check system boot parameters for ipv6.disable=1 combined with bridge configurations using neigh_suppress
• Review dmesg output for crash signatures matching the neigh_lookup function offset
• Audit network configurations for bridge interfaces with neighbor suppression enabled

Monitoring Recommendations

• Implement kernel crash dump collection and analysis for rapid incident response
• Configure alerts on kernel panic events, particularly those involving network subsystems
• Monitor for unexpected system reboots that may indicate exploitation attempts
• Deploy network monitoring to detect unusual ICMPv6 Neighbor Discovery traffic patterns

How to Mitigate CVE-2026-23381

Immediate Actions Required

• Apply the official kernel patches from the stable kernel branches
• As a temporary workaround, disable neigh_suppress on bridge interfaces if IPv6 is disabled
• Consider removing the ipv6.disable=1 boot parameter if IPv6 can be safely enabled
• Review and audit all bridge configurations in production environments

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches to address this vulnerability. The fix involves replacing the compile-time IS_ENABLED(IPV6) check with the runtime ipv6_mod_enabled() function, which properly handles the case when IPv6 is disabled via boot parameters. This effectively disables NS/NA suppression when IPv6 is not available, preventing the NULL pointer dereference.

Patches are available at the following commits:

• Kernel Git Commit 20ef5c2
• Kernel Git Commit 33dec6f
• Kernel Git Commit 7a894eb
• Kernel Git Commit a12cdaa
• Kernel Git Commit aa73deb
• Kernel Git Commit e5e8906

Workarounds

• Disable neighbor suppression on bridge interfaces using bridge link set dev <interface> neigh_suppress off
• Remove the ipv6.disable=1 boot parameter and manage IPv6 through firewall rules instead
• Implement network filtering to drop ICMPv6 Neighbor Discovery packets at the perimeter if neighbor suppression is required
• Consider network segmentation to limit exposure of vulnerable bridge configurations

# Disable neighbor suppression on bridge interface as temporary workaround
bridge link set dev br0 neigh_suppress off

# Verify the setting has been applied
bridge link show dev br0 | grep neigh_suppress