CVE-2026-53012 nexthop: fix IPv6 route referencing IPv4 nexthop

Medium 5.5 Published 24 Jun 2026 Updated 15 Oct 2026

A local attacker can trigger a kernel panic by manipulating IPv6 routes to reference IPv4 nexthops, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-53012?

CVE-2026-53012 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: fix IPv6 route referencing IPv4 nexthop

syzbot reported a panic [1] [2].

When an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag of all groups containing this nexthop is not updated. This is because nh_group_v4_update is only called when replacing AF_INET to AF_INET6, but the reverse direction (AF_INET6 to AF_INET) is missed.

This allows a stale has_v4=false to bypass fib6_check_nexthop, causing IPv6 routes to be attached to groups that effectively contain only AF_INET members. Subsequent route lookups then call nexthop_fib6_nh() which returns NULL for the AF_INET member, leading to a NULL pointer dereference.

Fix by calling nh_group_v4_update whenever the family changes, not just AF_INET to AF_INET6.

Reproducer: # AF_INET6 blackhole ip -6 nexthop add id 1 blackhole # group with has_v4=false ip nexthop add id 100 group 1 # replace with AF_INET (no -6), has_v4 stays false ip nexthop replace id 1 blackhole # pass stale has_v4 check ip -6 route add 2001:db8::/64 nhid 100 # panic ping -6 2001:db8::1

[1] https://syzkaller.appspot.com/bug?id=e17283eb2f8dcf3dd9b47fe6f67a95f71faadad0 [2] https://syzkaller.appspot.com/bug?id=8699b6ae54c9f35837d925686208402949e12ef3

Weakness: CWE-476

Which versions are affected by CVE-2026-53012?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-53012?

Apply the vendor's patch.

Is CVE-2026-53012 being exploited?

There is no known exploitation of CVE-2026-53012 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-53012, DEBIAN-CVE-2026-53012, GHSA-g5vp-298m-r34q, ROOT-OS-DEBIAN-11-CVE-2026-53012, ROOT-OS-DEBIAN-12-CVE-2026-53012, ROOT-OS-UBUNTU-2204-CVE-2026-53012 and 2 more.