CVE-2026-80646 ipv6: guard against possible NULL deref in __in6_dev_stats_get()
A NULL pointer dereference in the Linux kernel IPv6 subsystem can cause a system crash, requiring a kernel patch to prevent denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80646?
CVE-2026-80646 is a high-severity vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
dev_get_by_index_rcu() could return NULL if the original physical device is unregistered.
Found by Sashiko.
Which versions are affected by CVE-2026-80646?
How do I fix CVE-2026-80646?
Apply the vendor's patch.
Is CVE-2026-80646 being exploited?
There is no known exploitation of CVE-2026-80646 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80646, DEBIAN-CVE-2026-80646, GHSA-px76-4wr3-jjw7, UBUNTU-CVE-2026-80646.