CVE-2026-72392
CVE CVE-2026-72392EUVD EUVD-2026-59291Published 2026-08-15T05:56:20.000ZLast changed 2026-08-19T16:36:33.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump inet6_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6_new_table() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6_dump_table() to set w->root to the wrong table while w->node still points into the previous one. fib6_walk_continue() dereferences w->node->parent (NULL) and panics: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6_walk_continue+0x6e/0x170 Call Trace: <TASK> fib6_dump_table.isra.0+0xc5/0x240 inet6_dump_fib+0xf6/0x420 rtnl_dumpit+0x30/0xa0 netlink_dump+0x15b/0x460 netlink_recvmsg+0x1d6/0x2a0 ____sys_recvmsg+0x17a/0x190 Fix by storing tb->tb6_id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux patch: 6.18.40; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <ee73a32dd258d4af66831ff006b771e19812b322; patch: 7.1.5; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <110ccbd28c9444866fcc84ba96a2ad64fa6e95ae; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <27210d433a8c5fe6bf7278a04bbaeb49a81d0290; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <059efb48dd746518898faaa9b965511009b59639; patch: 6.12.97; patch: 7.2; patch: 5.10.265; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <9facb861dc6b9b9ea9793ef5032a9a826f7a4229; patch: 0; 2.6.19; patch: 6.1.183; patch: 5.15.212; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <cb90a774a9c6c46961a44949a246fbb61f5f934c; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <89f9c5fee3c64c5cabc34e65599308fd3c879cf9; 1b43af5480c351dbcb2eef478bafe179cbeb6e83 <d8a01d27873e04bebd357dc87859aa756e0b28b2; patch: 6.6.151
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.