CVE-2026-23442: Linux Kernel IPv6 SRv6 Null Pointer Flaw

CVE-2026-23442 Overview

A NULL pointer dereference vulnerability has been identified in the Linux kernel's IPv6 Segment Routing (SRv6) implementation. The vulnerability exists because __in6_dev_get() can return NULL when a device has no IPv6 configuration (for example, when MTU is less than IPV6_MIN_MTU or after NETDEV_UNREGISTER events), and the affected code paths in seg6_hmac_validate_skb() and ipv6_srh_rcv() failed to properly check for this condition before dereferencing the returned pointer.

Critical Impact

This vulnerability could allow an attacker to trigger a kernel panic or denial of service condition by sending specially crafted IPv6 packets to a system with SRv6 enabled on interfaces lacking proper IPv6 configuration.

Affected Products

• Linux Kernel (versions with SRv6 support prior to patches)
• Systems with IPv6 Segment Routing enabled
• Network devices processing SRv6 traffic with unconfigured IPv6 interfaces

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-23442 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-23442

Vulnerability Analysis

This vulnerability is classified as a NULL Pointer Dereference affecting the Linux kernel's IPv6 networking subsystem. The flaw occurs in the SRv6 (Segment Routing over IPv6) code paths where the kernel processes incoming IPv6 packets with Segment Routing Headers (SRH).

The root issue stems from inadequate validation in two specific functions: seg6_hmac_validate_skb() and ipv6_srh_rcv(). Both functions call __in6_dev_get() to retrieve the IPv6 device configuration structure (inet6_dev) but fail to verify that the returned pointer is valid before attempting to use it.

When a network device has no IPv6 configuration—either because its MTU is below the IPv6 minimum (1280 bytes) or because the device is being unregistered from the network stack via NETDEV_UNREGISTER—__in6_dev_get() returns NULL. Subsequent attempts to dereference this NULL pointer result in a kernel oops or panic, causing a denial of service condition.

Root Cause

The vulnerability exists due to missing NULL pointer validation after calls to __in6_dev_get() in the SRv6 packet processing paths. The kernel assumes that any device processing IPv6 SRv6 traffic will have a valid IPv6 configuration, which is not always the case. This assumption violation leads to undefined behavior when packets arrive on interfaces that lack proper IPv6 setup or are in the process of being removed from the system.

Attack Vector

An attacker with network access could exploit this vulnerability by sending specially crafted IPv6 packets with Segment Routing Headers to a target system. The attack requires:

1. The target system has SRv6 functionality enabled in the kernel
2. A network interface exists that either has MTU below IPv6 minimum or is undergoing deregistration
3. The attacker can route IPv6 SRH packets to reach the vulnerable interface

The vulnerability can be triggered remotely over the network without requiring authentication or user interaction. However, exploitation requires specific network configuration conditions to be present on the target system.

Detection Methods for CVE-2026-23442

Indicators of Compromise

• Kernel panic messages referencing seg6_hmac_validate_skb or ipv6_srh_rcv functions
• System crashes or unexpected reboots on systems processing IPv6 SRv6 traffic
• Kernel oops logs indicating NULL pointer dereferences in IPv6 networking code
• Unusual IPv6 packets with Segment Routing Headers targeting interfaces with minimal IPv6 configuration

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference messages in IPv6/SRv6 code paths
• Implement network intrusion detection rules to identify anomalous IPv6 SRH traffic patterns
• Deploy endpoint detection and response (EDR) solutions to detect kernel-level crashes and anomalies
• Use SentinelOne's kernel-level monitoring to identify exploitation attempts targeting this vulnerability

Monitoring Recommendations

• Enable kernel crash dump analysis to capture detailed information about potential exploitation attempts
• Configure alerting for system stability issues on network-facing servers with SRv6 enabled
• Monitor network traffic for IPv6 packets with unusual Segment Routing Header configurations
• Implement log aggregation to correlate potential exploitation attempts across multiple systems

How to Mitigate CVE-2026-23442

Immediate Actions Required

• Apply the official kernel patches from the Linux stable tree immediately
• Evaluate whether SRv6 functionality is required and disable it if not needed
• Ensure all network interfaces have proper IPv6 configuration or disable IPv6 on unused interfaces
• Update to a patched kernel version as soon as possible

Patch Information

The vulnerability has been resolved in the Linux kernel stable tree. The fix adds proper NULL checks for the idev pointer returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() functions.

Official patches are available:

• Kernel Git Commit 06413793
• Kernel Git Commit a25853c9

Workarounds

• Disable SRv6 functionality by unloading the seg6 kernel module if not required for operations
• Ensure all active network interfaces have valid IPv6 configuration with appropriate MTU settings
• Implement network-level filtering to block unexpected IPv6 SRH traffic from untrusted sources
• Use network segmentation to limit exposure of systems with SRv6 enabled

# Disable SRv6 module if not needed
sudo modprobe -r seg6
sudo modprobe -r seg6_hmac

# Prevent automatic loading at boot
echo "blacklist seg6" | sudo tee /etc/modprobe.d/disable-srv6.conf
echo "blacklist seg6_hmac" | sudo tee -a /etc/modprobe.d/disable-srv6.conf