CVE-2026-64116 Overview
CVE-2026-64116 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM) implementation. The flaw resides in the ipv6_hop_ioam() function, which accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via Read-Copy-Update (RCU), __in6_dev_get() may return NULL during interface teardown. An attacker able to trigger IOAM Hop-by-Hop option processing during interface teardown can crash the kernel, producing a denial-of-service condition.
Critical Impact
A remote, unauthenticated attacker can trigger a kernel NULL pointer dereference by sending IPv6 packets with IOAM Hop-by-Hop options during interface teardown, causing a kernel panic and system-wide denial of service.
Affected Products
- Linux kernel versions containing the IPv6 IOAM Hop-by-Hop processing implementation
- Distributions shipping affected upstream stable kernel branches
- Systems with IPv6 IOAM (ioam6) enabled on network interfaces
Discovery Timeline
- 2026-07-19 - CVE-2026-64116 published to the National Vulnerability Database
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64116
Vulnerability Analysis
The vulnerability exists in the IPv6 IOAM Hop-by-Hop option handler in the Linux networking stack. The function ipv6_hop_ioam() retrieves the per-interface IPv6 configuration by calling __in6_dev_get(skb->dev) and immediately dereferences the returned pointer to read the cnf.ioam6_enabled field. The kernel expects this pointer to be valid for any active IPv6-capable network device.
The race condition emerges when a network interface is being brought down while packets containing IOAM Hop-by-Hop extensions are still traversing the receive path. During teardown, addrconf_ifdown() clears the dev->ip6_ptr field under RCU protection. If a packet is processed after this clear but before the RCU grace period retires the packet handler, __in6_dev_get() returns NULL, and the subsequent field access dereferences a NULL pointer.
Root Cause
The root cause is missing NULL validation on the return value of __in6_dev_get(). The IOAM Hop-by-Hop handler treats the inet6_dev structure as always present, but RCU-protected teardown paths make this assumption incorrect. This is a classic Time-of-Check Time-of-Use (TOCTOU) pattern combined with a missing sanity check on a pointer returned by a lookup helper.
Attack Vector
Exploitation requires an attacker to send IPv6 traffic containing IOAM Hop-by-Hop options to a target system while a network interface is being torn down. Because IPv6 IOAM processing occurs before higher-layer authentication, no credentials or user interaction are required. The upstream fix adds a NULL check for idev and drops offending packets with SKB_DROP_REASON_IPV6DISABLED when the pointer is unavailable. The vulnerability manifests only as availability impact; there is no memory corruption or information disclosure.
Detection Methods for CVE-2026-64116
Indicators of Compromise
- Kernel panic messages referencing ipv6_hop_ioam or __in6_dev_get in the stack trace
- Oops entries in dmesg showing NULL pointer dereference at addresses associated with inet6_dev->cnf
- Unexpected interface flap events (ip link down/up) correlated with kernel crashes
- Increased volume of IPv6 packets carrying Hop-by-Hop extension headers with IOAM Type 49
Detection Strategies
- Monitor /var/log/kern.log and journald for BUG: unable to handle kernel NULL pointer dereference entries mentioning IPv6 hop-by-hop code paths
- Deploy eBPF probes on ipv6_hop_ioam to log calls where __in6_dev_get() returns NULL
- Inspect network telemetry for IPv6 Hop-by-Hop headers containing IOAM options directed at hosts undergoing interface state changes
Monitoring Recommendations
- Alert on repeated host reboots or kernel panics on IPv6-enabled endpoints and routers
- Track SKB_DROP_REASON_IPV6DISABLED drop counters after patching to confirm the fix engages under real traffic
- Correlate interface administrative state changes with inbound IPv6 extension header activity to detect targeted attempts
How to Mitigate CVE-2026-64116
Immediate Actions Required
- Update to a patched stable Linux kernel that includes the idev NULL check in ipv6_hop_ioam()
- Disable IPv6 IOAM on interfaces where it is not required by setting net.ipv6.conf.<iface>.ioam6_enabled=0
- Restrict IPv6 Hop-by-Hop options at network perimeter devices where operationally feasible
- Prioritize patching internet-facing hosts and routers that terminate or forward IPv6 traffic
Patch Information
The fix has been merged across multiple stable branches. Relevant upstream commits include Kernel Git Patch 09cbfd4, Kernel Git Patch 1dca7e4, Kernel Git Patch 902daaac, Kernel Git Patch abdd0322, Kernel Git Patch c7e8971a, Kernel Git Patch cf75eb66, and Kernel Git Patch d4ea0dfd. Apply the vendor kernel update that corresponds to your distribution branch.
Workarounds
- Disable IOAM6 globally with sysctl -w net.ipv6.conf.all.ioam6_enabled=0 where the feature is unused
- Drop IPv6 packets carrying Hop-by-Hop headers with IOAM options at edge firewalls using ip6tables or nftables rules
- Avoid administrative interface teardown on hosts that must remain reachable via IPv6 IOAM until patched
# Configuration example: disable IPv6 IOAM system-wide
sysctl -w net.ipv6.conf.all.ioam6_enabled=0
sysctl -w net.ipv6.conf.default.ioam6_enabled=0
# Persist across reboots
echo 'net.ipv6.conf.all.ioam6_enabled=0' >> /etc/sysctl.d/99-cve-2026-64116.conf
echo 'net.ipv6.conf.default.ioam6_enabled=0' >> /etc/sysctl.d/99-cve-2026-64116.conf
sysctl --system
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
