CVE-2026-97601 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
A local attacker can trigger a kernel crash via a specific netlink request due to a missing pointer check in the 6lowpan module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97601?
CVE-2026-97601 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
TUNSETLINK allows a TUN device to change its link-layer type to ARPHRD_IEEE802154 without initializing ieee802154_ptr. lowpan_newlink() checks only the device type before dereferencing the pointer, so an RTM_NEWLINK request can trigger a NULL pointer dereference.
Reject devices without ieee802154_ptr along with devices of the wrong type.
Which versions are affected by CVE-2026-97601?
How do I fix CVE-2026-97601?
Apply the vendor's patch.
Is CVE-2026-97601 being exploited?
There is no known exploitation of CVE-2026-97601 in the wild and no public exploit code.
Sources
Also known as AZL-104433, BELL-CVE-2026-97601, DEBIAN-CVE-2026-97601, GHSA-mh2g-wr94-hfmw, UBUNTU-CVE-2026-97601.