CVE-2026-64569: Linux Kernel Privilege Escalation Flaw

CVE-2026-64569 Overview

CVE-2026-64569 is a NULL pointer dereference vulnerability in the Linux kernel's Multiprotocol Label Switching (MPLS) subsystem. The flaw resides in mpls_valid_fib_dump_req() within net/mpls/af_mpls.c and only manifests on kernels built with CONFIG_INET=n. On such builds, the function walks the parsed attribute table directly rather than delegating to ip_valid_fib_dump_req(). The RTA_OIF handler passes tb[RTA_OIF] to nla_get_u32() without verifying the attribute is present, producing a NULL dereference when an RTM_GETROUTE dump for AF_MPLS is issued with strict checking and no RTA_OIF.

Critical Impact
An unprivileged local user can trigger a kernel NULL pointer dereference, causing a denial of service through kernel panic on affected CONFIG_INET=n Linux builds.

Affected Products

Linux kernel builds configured with CONFIG_INET=n that include the MPLS subsystem
Multiple stable branches referenced by upstream fix commits
Distribution kernels that ship MPLS support without IPv4 stack enabled

Discovery Timeline

2026-08-05 - CVE CVE-2026-64569 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64569

Vulnerability Analysis

The vulnerability affects the Linux kernel MPLS netlink route dump path. When CONFIG_INET is disabled, mpls_valid_fib_dump_req() provides its own validation logic instead of reusing ip_valid_fib_dump_req(). This alternate implementation dereferences netlink attribute entries without first checking whether they were supplied by the caller.

Specifically, the code path for RTA_OIF invokes nla_get_u32(tb[RTA_OIF]) unconditionally. If the netlink message contains no RTA_OIF attribute, tb[RTA_OIF] is NULL. The subsequent dereference triggers a general protection fault flagged by KASAN as null-ptr-deref in range [0x0000000000000000-0x0000000000000007].

The operation is RTM_GETROUTE, classified as RTNL_KIND_GET. The function rtnetlink_rcv_msg() permits this class of request without CAP_NET_ADMIN, so any unprivileged user with a netlink socket can send the malformed dump request. The result is a kernel oops and denial of service.

Root Cause

The root cause is missing input validation [CWE-476: NULL Pointer Dereference] on parsed netlink attributes. The CONFIG_INET=n code path in mpls_valid_fib_dump_req() does not skip unset attributes, diverging from the behavior of ip_valid_fib_dump_req() which handles absent attributes safely.

Attack Vector

An unprivileged local user opens an AF_NETLINK/NETLINK_ROUTE socket and issues an RTM_GETROUTE dump request targeting AF_MPLS with the strict-checking flag set and no RTA_OIF attribute. The kernel enters mpls_dump_routes(), calls mpls_valid_fib_dump_req(), and crashes when dereferencing the NULL tb[RTA_OIF] entry. See the upstream fix commits linked in the Kernel Git Commit Change 1 and related references for technical details.

Detection Methods for CVE-2026-64569

Indicators of Compromise

Kernel oops messages referencing mpls_valid_fib_dump_req in dmesg or /var/log/kern.log
KASAN reports containing null-ptr-deref with a call trace through mpls_dump_routes and rtnetlink_rcv_msg
Unexpected kernel panics or system reboots correlated with netlink activity from unprivileged processes

Detection Strategies

Audit kernel build configurations for CONFIG_INET=n combined with CONFIG_MPLS_ROUTING=y to identify vulnerable systems
Monitor for repeated RTM_GETROUTE netlink requests targeting AF_MPLS from non-privileged UIDs
Correlate kernel crash reports with process ancestry to identify triggering binaries

Monitoring Recommendations

Enable auditd rules covering sendmsg syscalls on AF_NETLINK sockets
Collect kernel ring buffer output centrally and alert on general protection fault entries referencing MPLS symbols
Track kernel package versions across the fleet to confirm patch coverage on stable branches

How to Mitigate CVE-2026-64569

Immediate Actions Required

Apply the upstream kernel patches that update mpls_valid_fib_dump_req() to skip unset attributes, mirroring ip_valid_fib_dump_req() behavior
Update to a distribution kernel that incorporates the fix commits listed in the kernel.org stable tree
On systems where MPLS is unused, unload or blacklist the mpls_router module to remove the attack surface

Patch Information

The fix is available in the upstream Linux kernel through the commits 06db79411a28, 56d96fededd6, 5f6e7b32bd1f, ad6284ced6a1, and d6eee7cd078a. The patch adds presence checks so unset netlink attributes are skipped rather than dereferenced.

Workarounds

Blacklist the MPLS module via /etc/modprobe.d/ on hosts that do not require MPLS routing
Restrict access to netlink sockets using seccomp or Linux Security Modules where feasible
Rebuild kernels with CONFIG_INET=y if MPLS support is required and the source is under local control

bash

# Disable the MPLS router module on hosts that do not need MPLS
echo 'blacklist mpls_router' | sudo tee /etc/modprobe.d/blacklist-mpls.conf
sudo modprobe -r mpls_router

# Verify the module is not loaded
lsmod | grep mpls