CVE-2026-64538: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64538 Overview

CVE-2026-64538 is a null pointer dereference vulnerability in the Linux kernel's IPv6 subsystem. The flaw resides in the fib6_nh_mtu_change() function, which re-fetches the idev structure via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. When addrconf_ifdown() clears dev->ip6_ptr after rt6_disable_ip() has released tb6_lock, a Router Advertisement (RA) driven MTU walk can observe a NULL idev and trigger a kernel oops. Nexthop-backed routes survive the addrconf_ifdown() flush, allowing the walk to reach the affected code path after ip6_ptr is nulled.

Critical Impact
Remote attackers on the local network segment can trigger a kernel general protection fault via crafted IPv6 Router Advertisements, causing denial of service on affected Linux hosts.

Affected Products

Linux kernel (IPv6 networking subsystem)
Distributions shipping kernels containing the vulnerable fib6_nh_mtu_change() code path
Systems processing IPv6 Router Advertisements with nexthop-backed routes

Discovery Timeline

2026-07-27 - CVE-2026-64538 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64538

Vulnerability Analysis

The vulnerability affects the IPv6 forwarding information base (FIB) code path that handles MTU updates driven by Router Advertisement messages. When an ICMPv6 Router Advertisement arrives, ndisc_router_discovery() invokes rt6_mtu_change(), which walks all routes via __fib6_clean_all() and calls rt6_mtu_change_route() for each entry. The caller correctly checks for a NULL idev on its own __in6_dev_get() result. However, fib6_nh_mtu_change() performs its own unguarded re-fetch of idev and immediately dereferences idev->cnf.mtu6.

A concurrent addrconf_ifdown() operation clears dev->ip6_ptr using RCU_INIT_POINTER() after rt6_disable_ip() has released tb6_lock. Because nexthop-backed routes survive the flush performed by addrconf_ifdown(), the MTU walk can still reach the vulnerable function and observe a NULL idev, producing a general protection fault [CWE-476].

Root Cause

The root cause is an inconsistent NULL-check contract between caller and callee. rt6_mtu_change_route() guards its __in6_dev_get() result, but fib6_nh_mtu_change() assumes idev will remain valid across the RCU-protected walk. Interface teardown breaks that assumption because nexthop-backed routes persist beyond the address configuration flush.

Attack Vector

An attacker on the same local network segment can send crafted IPv6 Router Advertisement packets containing MTU options. If the target host is concurrently tearing down an IPv6-enabled interface, the resulting rt6_mtu_change walk dereferences a NULL idev pointer and produces a kernel oops. The reported crash trace shows fib6_nh_mtu_change+0x203/0x990 reached through icmpv6_rcv() and ipv6_rcv(). Successful triggering causes denial of service on the affected host.

The fix returns 0 when idev is NULL inside fib6_nh_mtu_change(), matching the pattern applied by rt6_mtu_change_route() and the earlier fib6_mtu() fix in commit 5ad509c1fdad.

Detection Methods for CVE-2026-64538

Indicators of Compromise

Kernel oops messages referencing fib6_nh_mtu_change in dmesg or /var/log/kern.log
KASAN reports indicating null-ptr-deref in the range [0x00000000000002a8-0x00000000000002af]
Unexpected reboots or panics correlated with IPv6 interface state changes
Bursts of inbound ICMPv6 Router Advertisement packets containing MTU options from unexpected sources

Detection Strategies

Monitor kernel ring buffer entries containing general protection fault and IPv6 stack symbols such as rt6_mtu_change, __fib6_clean_all, or ndisc_router_discovery
Inspect network telemetry for ICMPv6 Type 134 (Router Advertisement) messages from non-authorized routers on local segments
Correlate host crash events with IPv6 interface administrative state transitions (ifdown, ip link set down)

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on IPv6 stack panics
Enable RA Guard on managed switches to block unauthorized Router Advertisements
Track kernel package versions across the fleet to identify hosts running vulnerable builds

How to Mitigate CVE-2026-64538

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits linked in the NVD advisory
Prioritize patching hosts exposed to untrusted IPv6 network segments, including guest networks and cloud tenant boundaries
Deploy RA Guard or equivalent Layer 2 filtering to restrict which devices may send Router Advertisements

Patch Information

The fix is available in multiple stable kernel branches through the following commits: Kernel Git Commit 1451deca, Kernel Git Commit 302d57ed, Kernel Git Commit 46c3b819, Kernel Git Commit 6428634f, Kernel Git Commit 80600b5d, Kernel Git Commit b0d0eb13, Kernel Git Commit b2c70dd3, and Kernel Git Commit d08d019f. The patch adds a NULL check on idev in fib6_nh_mtu_change() and returns 0 when the pointer is NULL.

Workarounds

Disable IPv6 on hosts that do not require it using sysctl net.ipv6.conf.all.disable_ipv6=1
Configure accept_ra=0 on interfaces that should not process Router Advertisements
Enforce RA Guard on network infrastructure to drop unauthorized ICMPv6 Type 134 packets

bash

# Disable Router Advertisement processing on a specific interface
sysctl -w net.ipv6.conf.eth0.accept_ra=0

# Disable IPv6 globally where not required
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1

# Persist settings
echo 'net.ipv6.conf.all.disable_ipv6=1' >> /etc/sysctl.d/99-ipv6.conf