CVE-2026-80646 Overview
CVE-2026-80646 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 networking subsystem. The flaw resides in the __in6_dev_stats_get() function, which relies on dev_get_by_index_rcu() to resolve the original physical device. When the underlying physical device has been unregistered, dev_get_by_index_rcu() returns NULL, and the subsequent dereference triggers a kernel crash.
The issue was identified by Sashiko and resolved through a series of stable kernel commits. Successful exploitation results in a denial of service condition through kernel panic on affected systems.
Critical Impact
A NULL pointer dereference in the IPv6 stack allows local or network-adjacent conditions to trigger a kernel panic, resulting in loss of availability for the affected host.
Affected Products
- Linux kernel — IPv6 networking subsystem (net/ipv6)
- Multiple stable kernel branches referenced in the upstream fix commits
- Distributions shipping affected upstream kernel versions
Discovery Timeline
- Vulnerability reported by Sashiko (per upstream commit message)
- 2026-08-28 - CVE-2026-80646 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80646
Vulnerability Analysis
The vulnerability is a NULL pointer dereference [CWE-476] inside the IPv6 device statistics retrieval path. The function __in6_dev_stats_get() calls dev_get_by_index_rcu() to look up a network device by index under RCU protection. The return value was used without a NULL check, assuming the referenced physical device would always be present.
The assumption breaks when the original physical device is unregistered while the lookup executes. In that window, dev_get_by_index_rcu() returns NULL, and any subsequent field access dereferences a NULL pointer inside kernel context. The resulting fault terminates the current task and typically panics the kernel depending on panic_on_oops configuration.
The attack vector requires reaching the code path that queries IPv6 device statistics for a tunnel or logical interface whose backing physical device can be removed. This condition is exposed through interface teardown races on systems with dynamic device management, containerized network namespaces, or hot-plug networking hardware.
Root Cause
The root cause is a missing NULL check on the return value of dev_get_by_index_rcu(). Kernel networking helpers that resolve devices by ifindex are documented to return NULL when no matching device exists, including cases where the device was concurrently unregistered. The fix introduces the required guard before dereferencing the returned net_device pointer.
Attack Vector
An attacker with the ability to induce device unregistration while another task queries IPv6 statistics on a dependent virtual interface can trigger the crash. In containerized or multi-tenant environments, workloads that manipulate network namespaces or tunnel endpoints may reach this state without elevated privileges. Consult the upstream commit series for the exact code path.
Detection Methods for CVE-2026-80646
Indicators of Compromise
- Kernel oops or panic messages referencing __in6_dev_stats_get in the call trace
- Unexpected reboots or kernel crash dumps on hosts running IPv6-enabled tunnels or virtual interfaces
- dmesg output containing BUG: kernel NULL pointer dereference correlated with IPv6 statistics collection
Detection Strategies
- Monitor kernel logs for oops or panic events with stack frames including in6_dev_stats_get, dev_get_by_index_rcu, or nearby IPv6 statistics symbols.
- Correlate host reboots with preceding network namespace or interface teardown activity to identify race-induced crashes.
- Inventory kernel versions across the fleet against the fixed commit hashes to identify unpatched hosts.
Monitoring Recommendations
- Forward kernel.log, dmesg, and crashkernel dumps to a central telemetry pipeline for anomaly review.
- Alert on repeated availability loss on hosts that host containers, tunnels, or virtualized network stacks.
- Track uname -r output across managed endpoints to confirm patch coverage after remediation.
How to Mitigate CVE-2026-80646
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits to all affected hosts.
- Prioritize patching systems that expose network namespaces, IPv6 tunnels, or dynamic interface management to untrusted workloads.
- Enable kernel crash reporting so future occurrences produce diagnostic data.
Patch Information
The fix adds a NULL check on the return of dev_get_by_index_rcu() inside __in6_dev_stats_get(). It has been backported across multiple stable branches. Relevant commits include 1e3db30a8881, 0db1949084e8, 1a4adfbeb47a, 507541c2a8ee, 952426a83ca7, a23f2c68c663, e14db4367794, and fc920c0659cd. Consume distribution kernel updates as they publish backports.
Workarounds
- Restrict unprivileged access to network namespace creation using sysctl kernel.unprivileged_userns_clone=0 where policy allows.
- Limit IPv6 tunnel and virtual interface configuration to trusted administrative users until patches are applied.
- Enable kdump and configure panic_on_oops handling aligned with organizational availability requirements to preserve forensic data.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.