CVE-2026-23304 ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
A NULL pointer dereference in the Linux kernel IPv6 routing code can cause a system crash when a network device is un-slaved from a VRF.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23304?
CVE-2026-23304 is a medium-severity vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address").
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437)
I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too.
Weakness: CWE-476
Which versions are affected by CVE-2026-23304?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23304?
Apply the vendor's patch.
Is CVE-2026-23304 being exploited?
There is no known exploitation of CVE-2026-23304 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80645, BELL-CVE-2026-23304, DEBIAN-CVE-2026-23304, GHSA-3qgv-qj84-5mmh, ROOT-OS-DEBIAN-11-CVE-2026-23304, ROOT-OS-DEBIAN-12-CVE-2026-23304 and 4 more.