CVE-2026-23300 net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
A local attacker can cause a kernel panic by creating a specific IPv6 loopback nexthop referenced by an IPv4 route, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23300?
CVE-2026-23300 is a medium-severity vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies it as a reject route. This is because nexthop objects have no destination prefix (fc_dst=::), causing fib6_is_reject() to match any loopback nexthop. The reject path skips fib_nh_common_init(), leaving nhc_pcpu_rth_output unallocated. If an IPv4 route later references this nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and panics.
Simplify the check in fib6_nh_init() to only match explicit reject routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback promotion heuristic in fib6_is_reject() is handled separately by ip6_route_info_create_nh(). After this change, the three cases behave as follows:
1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"): RTF_REJECT is set, enters reject path, skips fib_nh_common_init(). No behavior change.
2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. ip6_route_info_create_nh() still promotes it to reject afterward. nhc_pcpu_rth_output is allocated but unused, which is harmless.
3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. nhc_pcpu_rth_output is properly allocated, fixing the crash when IPv4 routes reference this nexthop.
Weakness: CWE-476
Which versions are affected by CVE-2026-23300?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23300?
Apply the vendor's patch.
Is CVE-2026-23300 being exploited?
There is no known exploitation of CVE-2026-23300 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80697, BELL-CVE-2026-23300, DEBIAN-CVE-2026-23300, GHSA-77gg-4hmh-hwxc, ROOT-OS-DEBIAN-11-CVE-2026-23300, ROOT-OS-DEBIAN-12-CVE-2026-23300 and 4 more.