CVE-2026-64542

CVE CVE-2026-64542EUVD EUVD-2026-49593Published 2026-07-27T20:10:34.000ZLast changed 2026-08-03T09:32:42.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check, even though its only caller ndisc_recv_na() already fetched and NULL-checked idev for the same device. Both reads of dev->ip6_ptr run in the same RCU read-side critical section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchronize_net() that orders the unregister path, so the re-fetch returns NULL and oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974) Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndisc_recv_na (net/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_input.c:534) ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_input.c:635) ipv6_rcv (net/ipv6/ip6_input.c:351) </IRQ> It is reachable by an unprivileged user via a network namespace. Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev->ip6_ptr has been cleared.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 <62c719203cb521b64fab74da94a81bdde5c18808; aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 <160d3f0d7a556ceae505dcab521a37057b4ce28f; patch: 6.12.97; 6.0; aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 <d186e942365acece7c56d39da05dd63bf95b280a; patch: 7.1.5; patch: 6.6.148; patch: 7.2-rc1; patch: 6.18.40; aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 <63d1c23764de2309cedbb779c75188d257a09d9b; patch: 0; aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 <a6450f7cfae57b382cbaf66a577765c9a88b3c58

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.