CVE-2026-23442 ipv6: add NULL checks for idev in SRv6 paths
A missing NULL check in Linux kernel SRv6 paths allows attackers to trigger a kernel crash via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23442?
CVE-2026-23442 is a medium-severity vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: add NULL checks for idev in SRv6 paths
__in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER).
Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences.
Weakness: CWE-476
Which versions are affected by CVE-2026-23442?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23442?
Apply the vendor's patch.
Is CVE-2026-23442 being exploited?
There is no known exploitation of CVE-2026-23442 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-81843, BELL-CVE-2026-23442, DEBIAN-CVE-2026-23442, GHSA-prgg-rgfw-vr94, ROOT-OS-DEBIAN-11-CVE-2026-23442, ROOT-OS-DEBIAN-12-CVE-2026-23442 and 4 more.