CVE-2026-53214 Overview
CVE-2026-53214 is a null pointer dereference vulnerability in the Linux kernel's IPv6 networking subsystem. The flaw resides in the cleanup_prefix_route() function within net/ipv6/addrconf.c. The function addrconf_get_prefix_route() can return the fib6_null_entry sentinel value, which contains a NULLfib6_table pointer. When cleanup_prefix_route() subsequently attempts to acquire a spinlock on this NULL table pointer, the kernel triggers a general protection fault. The issue is reachable through standard netlink address deletion paths via inet6_rtm_deladdr(). The vulnerability has been resolved upstream through patches across multiple stable kernel branches.
Critical Impact
Local users can trigger a kernel-level null pointer dereference through netlink IPv6 address deletion requests, causing denial of service.
Affected Products
- Linux kernel IPv6 networking subsystem (net/ipv6/addrconf.c)
- Multiple stable Linux kernel branches prior to the referenced fix commits
- Distributions shipping vulnerable kernel versions
Discovery Timeline
- 2026-06-25 - CVE-2026-53214 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53214
Vulnerability Analysis
The vulnerability is a null pointer dereference [CWE-476] in the IPv6 address configuration code. The cleanup_prefix_route() function is invoked during IPv6 address deletion to update or remove the route associated with a prefix. It calls addrconf_get_prefix_route() to locate the relevant FIB6 entry, then proceeds to set the route's expiration time. When no matching route exists, addrconf_get_prefix_route() returns the fib6_null_entry sentinel. This sentinel structure has a NULLfib6_table member. The subsequent code path attempts to acquire fib6_table->tb6_lock via _raw_spin_lock_bh(), dereferencing the NULL pointer and triggering a general protection fault detected by KASAN as a null-ptr-deref in range [0x30-0x37].
Root Cause
The root cause is missing validation of the return value from addrconf_get_prefix_route(). Other callers in the same file handle this case correctly: addrconf_prefix_rcv() filters with RTF_ADDRCONF | RTF_PREFIX_RT flags that the null entry lacks, modify_prefix_route() received an earlier fix in commit a747e02430df, and __ipv6_ifa_notify() routes through ip6_del_rt() which explicitly checks for fib6_null_entry. Only cleanup_prefix_route() performed no such check before dereferencing the table pointer.
Attack Vector
The condition is reached through the netlink interface via RTM_DELADDR messages handled by inet6_rtm_deladdr(). The call chain is netlink_sendmsg() → rtnetlink_rcv_msg() → inet6_rtm_deladdr() → inet6_addr_del() → ipv6_del_addr() → cleanup_prefix_route(). A local user with sufficient privileges to send RTM_DELADDR netlink messages can trigger the kernel panic by deleting an IPv6 address under conditions where the associated prefix route lookup returns the null sentinel.
No verified public exploit code is available. The vulnerability mechanism is described in the upstream commit message and KASAN trace. See the Linux Kernel Patch 653a284 for the fix implementation.
Detection Methods for CVE-2026-53214
Indicators of Compromise
- Kernel oops messages referencing cleanup_prefix_route in the call trace
- KASAN reports indicating null-ptr-deref in the address range [0x30-0x37] during IPv6 address removal
- Unexpected kernel general protection faults coinciding with RTM_DELADDR netlink activity
Detection Strategies
- Monitor dmesg and /var/log/kern.log for general protection fault entries mentioning ipv6_del_addr or inet6_rtm_deladdr
- Audit installed kernel package versions against the fixed commits 07d9a08, 192df37, 5f82b02, 653a284, and b70c687
- Correlate kernel crash dumps with concurrent netlink socket activity from unprivileged or sandboxed processes
Monitoring Recommendations
- Enable persistent kernel crash collection via kdump to capture panics for forensic review
- Track netlink RTM_DELADDR syscall patterns on hosts with frequent IPv6 reconfiguration
- Alert on host availability degradation tied to kernel oops events in centralized log aggregation
How to Mitigate CVE-2026-53214
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry across all affected systems
- Update to a distribution kernel package that includes the cleanup_prefix_route() fix
- Reboot systems after patching to load the corrected kernel image
Patch Information
The fix adds a check for fib6_null_entry before dereferencing the fib6_table pointer in cleanup_prefix_route(). Fixes were merged in commits 07d9a08, 192df37, 5f82b02, 653a284, and b70c687 across stable branches.
Workarounds
- Restrict CAP_NET_ADMIN to trusted accounts to limit who can issue RTM_DELADDR netlink messages
- Disable IPv6 on hosts that do not require it via sysctl net.ipv6.conf.all.disable_ipv6=1 where operationally feasible
- Apply seccomp or namespace restrictions to limit untrusted workloads from issuing netlink address manipulation calls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
