Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:49.550Z",
  "pubdate": "2026-08-28T08:16:49.550Z",
  "executiveSummary": "This vulnerability involves a NULL pointer dereference within the Linux kernel's IPv6 networking stack, specifically residing in the __in6_dev_stats_get() function.\nThe issue arises from a lack of validation regarding the return value of dev_get_by_index_rcu() when a physical network interface is unregistered from the system.\nIf an attacker or a system event triggers the removal of an interface while the kernel is attempting to retrieve statistics associated with that device, the kernel may attempt to access memory at a NULL address.\nThis leads to a kernel panic, resulting in a Denial of Service (DoS) for the affected host.\nThe vulnerability is localized to the IPv6 subsystem and does not require complex authentication or specific user privileges, as it can potentially be triggered by processes capable of interacting with the networking stack or interface management.\nThe primary risk is system instability and unplanned downtime due to kernel-level crashes.",
  "technicalDetails": "The root cause of this vulnerability is an improper handling of the return value from the dev_get_by_index_rcu() function within the __in6_dev_stats_get() routine. In the Linux networking subsystem, dev_get_by_index_rcu() is responsible for looking up a network device structure (net_device) based on a provided index while maintaining RCU read-side critical section protections.\nWhen a physical network device is unregistered or removed from the system—often due to hot-unplugging, virtual interface deletion, or namespace transitions—the device lookup may fail to resolve, causing dev_get_by_index_rcu() to return a NULL pointer. The current implementation of __in6_dev_stats_get() fails to verify the validity of the returned pointer before proceeding to access members of the in6_dev structure associated with the device.\nThe attack flow initiates when the kernel or a user-space utility attempts to query IPv6 statistics (via SNMP or procfs interfaces) for an interface that has been queued for removal or is in the process of being unregistered. If the timing of the request coincides with the device unregistration event, the kernel accesses the dereferenced NULL pointer, leading to a synchronous page fault in kernel mode. Since kernel-space NULL pointer dereferences cannot be handled gracefully, the kernel triggers an oops or a kernel panic, immediately terminating the execution flow and causing a system-wide Denial of Service.\nBecause this occurs in the core networking stack, the vulnerability is reachable through various network monitoring or management interfaces that interact with the IPv6 statistics tracking mechanism. The exploitation does not necessarily require highly sophisticated network payloads; rather, it relies on triggering a race condition between system-level device management and network monitoring functions. The impact is significant because it allows a low-privileged actor to cause a crash if they have the capability to interact with network interface lifecycle management or can influence monitoring requests targeting the affected IPv6 infrastructure."
}