CVE-2026-89561: Linux Kernel IPv6 Use-After-Free Vulnerability

CVE-2026-89561 Overview

CVE-2026-89561 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) source routing header handler. The flaw resides in the ipv6_rpl_srh_rcv() function, which dereferences the idev pointer returned by __in6_dev_get() without verifying it is non-NULL before reading idev->cnf.rpl_seg_enabled. A remote attacker can trigger the condition by sending IPv6 packets while the target interface's MTU transitions below IPV6_MIN_MTU, causing addrconf_ifdown() to clear dev->ip6_ptr via RCU_INIT_POINTER().

Critical Impact
Remote attackers can crash the Linux kernel over the network without authentication, resulting in system-wide denial of service.

Affected Products

Linux kernel builds with IPv6 RPL source routing enabled
Distributions shipping kernels prior to the fixing commits 63f50e9f90d0, eab3a917cdcb, and f826df95332c
Systems processing IPv6 routing headers on interfaces subject to MTU changes

Discovery Timeline

2026-09-11 - CVE-2026-89561 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89561

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] on the IPv6 receive path. ipv6_rpl_srh_rcv() reads idev->cnf.rpl_seg_enabled on an inet6 device pointer that may already have been torn down. Kernel Address Sanitizer (KASAN) reports the fault as a null-ptr-deref at offset 0x6b4, triggered from softirq context during ip6_protocol_deliver_rcu().

The bug is reachable from an unauthenticated network position. Any host able to send IPv6 packets to the affected interface can trigger the crash while the interface's MTU is being adjusted. Successful exploitation yields a kernel panic and denial of service.

Root Cause

When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr using RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can subsequently reach ipv6_rpl_srh_rcv() after dev->ip6_ptr has become NULL. The RPL handler then calls __in6_dev_get() and dereferences the returned pointer without a NULL guard, producing the fault.

Attack Vector

Exploitation requires only IPv6 network reachability to the target interface. The public reproducer floods the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200. On systems where an attacker can influence link parameters or race a legitimate MTU change, the same conditions can be induced remotely. No authentication or user interaction is required.

The fix moves the idev lookup to ipv6_rthdr_rcv(), which is the sole caller of both ipv6_rpl_srh_rcv() and ipv6_srh_rcv(). Both callees now receive idev as an argument, and packets on a torn-down interface are dropped once with SKB_DROP_REASON_IPV6DISABLED.

Detection Methods for CVE-2026-89561

Indicators of Compromise

Kernel panic or BUG: KASAN: null-ptr-deref messages referencing ipv6_rpl_srh_rcv+ in stack traces
Unexpected soft lockups or reboots on hosts processing IPv6 traffic with routing headers
Elevated volumes of IPv6 packets carrying RPL source routing headers (routing type 3) toward exposed interfaces
Frequent link state or MTU change events on IPv6-facing interfaces coinciding with crashes

Detection Strategies

Parse dmesg, journalctl -k, and kdump cores for stack traces containing ipv6_rpl_srh_rcv, ip6_protocol_deliver_rcu, or ipv6_rthdr_rcv
Inspect network telemetry for IPv6 packets with Next Header 43 and routing type 3 (RPL), which are rare in most production environments
Correlate host crash events with interface NETDEV_CHANGEMTU events using kernel audit or ip monitor link logging

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging platform for pattern matching on the affected symbol names
Alert on repeated kernel oops or panic events across Linux fleets to surface exploitation attempts quickly
Monitor perimeter and internal firewalls for IPv6 routing header traffic and treat unexpected RPL headers as suspicious

How to Mitigate CVE-2026-89561

Immediate Actions Required

Apply vendor-supplied kernel updates that incorporate the upstream fix as soon as they are available for your distribution
Inventory Linux hosts exposing IPv6 interfaces to untrusted networks and prioritize them for patching
If patching is delayed, restrict IPv6 routing header type 3 (RPL) traffic at network boundaries

Patch Information

The upstream fix is committed in the mainline and stable trees. Refer to the following commits: Kernel commit 63f50e9, Kernel commit eab3a91, and Kernel commit f826df9. The patch relocates the idev NULL check to ipv6_rthdr_rcv() so packets on a torn-down interface are dropped before reaching the RPL or SRH handlers.

Workarounds

Disable RPL segment processing on interfaces where it is not required by setting the per-interface rpl_seg_enabled sysctl to 0
Drop inbound IPv6 packets carrying routing headers using ip6tables or nftables rules on hosts that do not require IPv6 source routing
Avoid dynamic MTU changes below IPV6_MIN_MTU on interfaces exposed to untrusted IPv6 traffic

bash

# Disable RPL segment processing on all IPv6 interfaces
sysctl -w net.ipv6.conf.all.rpl_seg_enabled=0
sysctl -w net.ipv6.conf.default.rpl_seg_enabled=0

# Drop inbound IPv6 packets with routing headers using nftables
nft add rule inet filter input meta nfproto ipv6 exthdr rt exists drop