CVE-2026-64542: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64542 Overview

CVE-2026-64542 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 Neighbor Discovery (NDISC) subsystem. The flaw resides in accept_untracked_na(), which re-fetches the inet6_dev structure via __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check. A concurrent addrconf_ifdown() triggered by lowering the MTU below IPV6_MIN_MTU can clear dev->ip6_ptr between the two reads, causing a kernel oops. An unprivileged user can reach the vulnerable code path via a network namespace, making this a local denial-of-service condition against the host kernel.

Critical Impact
Unprivileged local users can trigger a kernel NULL pointer dereference through IPv6 neighbor advertisement processing, resulting in a kernel crash and denial of service.

Affected Products

Linux kernel IPv6 stack (net/ipv6/ndisc.c)
Kernel builds containing the accept_untracked_na() code path prior to the referenced fix commits
Systems with IPv6 enabled and reachable network namespaces for unprivileged users

Discovery Timeline

2026-07-27 - CVE-2026-64542 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64542

Vulnerability Analysis

The vulnerability lives inside the IPv6 Neighbor Discovery receive path. When ndisc_recv_na() processes an incoming neighbor advertisement, it first fetches the interface's IPv6 configuration structure (inet6_dev) from dev->ip6_ptr and performs a NULL check. It then calls accept_untracked_na(), which redundantly re-fetches the same pointer via __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without validating the result.

Both reads occur within the same RCU read-side critical section. However, a concurrent call to addrconf_ifdown() can clear dev->ip6_ptr between the two fetches. Lowering the interface MTU below IPV6_MIN_MTU invokes addrconf_ifdown() without the synchronize_net() barrier that normally orders the device unregister path. The second fetch therefore returns NULL, and the subsequent dereference at offset 0x364 produces the kernel oops observed in KASAN traces.

Root Cause

The defect is a classic Time-of-Check Time-of-Use (TOCTOU) style race combined with a missing NULL check. The function trusted that dev->ip6_ptr would remain stable inside the RCU section, but the MTU-lowering code path breaks that invariant by clearing the pointer without the expected synchronization.

Attack Vector

An unprivileged local user with permission to create a network namespace can construct an interface, arrange for concurrent MTU changes below IPV6_MIN_MTU, and inject crafted IPv6 neighbor advertisements. Winning the race causes the kernel to dereference a NULL idev pointer inside ndisc_recv_na(), panicking or oopsing the kernel and denying service to all workloads on the host.

The upstream fix passes the caller's already-validated idev into accept_untracked_na() instead of re-fetching it, ensuring the pointer stays alive for the RCU critical section even if dev->ip6_ptr is cleared. Technical details are available in the Kernel Git Commit 62c7192, Kernel Git Commit 63d1c23, Kernel Git Commit a6450f7, and Kernel Git Commit d186e94.

Detection Methods for CVE-2026-64542

Indicators of Compromise

Kernel oops or panic messages referencing ndisc_recv_na at net/ipv6/ndisc.c:974 in dmesg or /var/log/kern.log
KASAN reports of the form BUG: KASAN: null-ptr-deref in ndisc_recv_na with a read at address 0x0000000000000364
Unexpected host reboots correlated with IPv6 traffic bursts or MTU changes on unprivileged network namespaces

Detection Strategies

Monitor kernel log streams for stack traces containing ndisc_recv_na, icmpv6_rcv, and ip6_protocol_deliver_rcu sequences following interface MTU changes.
Audit unprivileged processes creating network namespaces and adjusting IPv6 interface MTU values via ip link set mtu or setsockopt calls.
Correlate crash dumps against the running kernel build to confirm whether the fix commits are present.

Monitoring Recommendations

Ingest kmsg, journald, and crash-dump telemetry into a centralized analytics platform so kernel oops signatures can be searched across the fleet.
Track unprivileged use of unshare(CLONE_NEWNET) and namespace lifecycle events alongside interface MTU modifications.
Alert on repeated ICMPv6 neighbor advertisement volume anomalies targeted at freshly created interfaces.

How to Mitigate CVE-2026-64542

Immediate Actions Required

Apply the upstream stable kernel patches referenced in commits 62c71920, 63d1c237, a6450f7c, and d186e942 as soon as they are available in your distribution's stable channel.
Inventory hosts running affected kernel versions and prioritize multi-tenant systems where unprivileged users can create network namespaces.
Restrict user_namespaces and unshare capabilities for untrusted local users while patch rollout is in progress.

Patch Information

The upstream fix changes accept_untracked_na() to accept the already-validated idev pointer from ndisc_recv_na() rather than re-fetching it. Because idev is protected by the caller's RCU critical section, the fix eliminates the NULL dereference even when dev->ip6_ptr is cleared by a concurrent addrconf_ifdown(). Backports are available across stable trees via Kernel Git Commit 62c7192, Kernel Git Commit 63d1c23, Kernel Git Commit a6450f7, and Kernel Git Commit d186e94.

Workarounds

Disable unprivileged user namespaces where operationally acceptable by setting kernel.unprivileged_userns_clone=0 or the equivalent user.max_user_namespaces=0 sysctl.
Disable IPv6 on interfaces that do not require it via net.ipv6.conf.all.disable_ipv6=1 to eliminate the vulnerable code path.
Restrict CAP_NET_ADMIN inside untrusted containers so attackers cannot modify interface MTU values to trigger the race.

bash

# Configuration example: reduce attack surface until patched kernel is deployed
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1

# Verify running kernel version against distribution patch advisories
uname -r