CVE-2026-98379: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-98379 Overview

CVE-2026-98379 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 netfilter reverse-path filter module (ip6t_rpfilter). The flaw originates in ip6_route_lookup(), which can return an error-free route whose rt6i_idev field is NULL. An unprivileged user operating inside a private user and network namespace can construct this state through rtnetlink and trigger the dereference via an IPv6 rpfilter lookup. The result is a kernel general protection fault leading to a panic.

Critical Impact
Local unprivileged users can trigger a kernel panic (denial of service) from within an unprivileged user namespace by inducing a NULL inet6_dev dereference in the IPv6 netfilter path.

Affected Products

Linux kernel (upstream) IPv6 netfilter subsystem (net/ipv6/netfilter/ip6t_rpfilter.c)
Stable kernel branches patched across multiple commits referenced in kernel.org git
Distributions shipping affected stable kernels prior to applying the fix

Discovery Timeline

2026-10-09 - CVE-2026-98379 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98379

Vulnerability Analysis

The rpfilter_mt function in net/ipv6/netfilter/ip6t_rpfilter.c performs reverse-path validation on incoming IPv6 packets. It calls ip6_route_lookup() and then dereferences the rt6i_idev pointer on the returned route to inspect the inbound interface. The lookup can return a route object with no associated inet6_dev, causing rpfilter_mt to dereference a NULL pointer at offset calculations that KASAN flags as null-ptr-deref in range [0x0..0x7].

The faulting path is reached during soft-IRQ processing of received packets, propagating through ipv6_rcv(), nf_hook_slow(), ip6t_do_table(), and finally rpfilter_mt(). Because the fault occurs in interrupt context, the kernel panics with "Fatal exception in interrupt".

Root Cause

Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev structure. However, fib6_ifdown() leaves routes that reference nexthop objects in the Forwarding Information Base (FIB). Subsequent lookups return these stale routes with rt6i_idev == NULL, and no caller in the rpfilter path validated the field before dereference.

Attack Vector

An unprivileged attacker creates a private user namespace and network namespace, then uses rtnetlink to configure interfaces, routes, and nexthop objects. By lowering a nexthop device MTU below IPV6_MIN_MTU, the attacker leaves FIB entries pointing to a device without an inet6_dev. Transmitting a crafted IPv6 packet that triggers rpfilter evaluation causes the kernel to dereference the NULL pointer and panic.

No authentication to a remote service is required. Exploitation is local and requires the ability to create user namespaces, which is enabled by default on most modern distributions. The patch resolves the issue by rejecting routes without an inet6_dev immediately after lookup; such routes are not eligible for reverse-path filtering, and the early check guards all later rt6i_idev dereferences.

Detection Methods for CVE-2026-98379

Indicators of Compromise

Kernel log entries containing general protection fault and KASAN: null-ptr-deref with RIP: rpfilter_mt or a stack trace through ip6t_do_table and nf_hook_slow.
Unexpected kernel panics with the message Fatal exception in interrupt on hosts where IPv6 rpfilter rules are active.
Repeated creation of user and network namespaces by unprivileged processes followed by rtnetlink activity that modifies IPv6 nexthop MTUs.

Detection Strategies

Monitor /var/log/kern.log and dmesg for faults originating in net/ipv6/netfilter/ip6t_rpfilter.c.
Collect kernel crash dumps via kdump and inspect the backtrace for the rpfilter_mt → ip6t_do_table → ipv6_rcv sequence.
Audit unprivileged use of CLONE_NEWUSER and CLONE_NEWNET combined with AF_NETLINK writes targeting route and nexthop configuration.

Monitoring Recommendations

Enable auditd rules on clone, unshare, and setns syscalls to track namespace creation by non-root users.
Forward kernel ring buffer events and host crash telemetry to a centralized SIEM or data lake for correlation across fleet nodes.
Alert on hosts experiencing recurring IPv6-related kernel panics, which may indicate active probing or exploitation attempts.

How to Mitigate CVE-2026-98379

Immediate Actions Required

Apply the upstream kernel fix that rejects routes without an inet6_dev in rpfilter_mt as soon as your distribution publishes an updated package.
If patching is not immediately possible, disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (upstream).
Review workloads that depend on IPv6 rpfilter rules and validate kernel versions on all nodes.

Patch Information

The fix adds an early check in rpfilter_mt to reject routes whose rt6i_idev is NULL, protecting all subsequent dereferences. The patch is distributed across multiple stable branches via the following commits: 1681ab6, 1b9b532, 290c96e, 3a7384b, 65487e9, eafe081, f49da48, and f4de787.

Workarounds

Restrict unprivileged user namespace creation via sysctl (kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0).
Remove IPv6 rpfilter rules from affected hosts where reverse-path filtering is non-essential until the kernel is patched.
Constrain CAP_NET_ADMIN within containers and apply seccomp profiles that block namespace creation syscalls for untrusted workloads.

bash

# Disable unprivileged user namespaces as a temporary mitigation
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w user.max_user_namespaces=0

# Persist across reboots
echo 'kernel.unprivileged_userns_clone=0' | tee -a /etc/sysctl.d/99-cve-2026-98379.conf
echo 'user.max_user_namespaces=0' | tee -a /etc/sysctl.d/99-cve-2026-98379.conf