High · published July 19, 2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Reported by Sashiko:
The function ipv6_hop_ioam() accesses
__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned
idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr
via RCU, __in6_dev_get() can return NULL during interface teardown, which
could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop
option.
Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.15, < 5.15.210 | 5.15.210 |
| linux/linux_kernel | ≥ 5.16, < 6.1.176 | 6.1.176 |
| linux/linux_kernel | ≥ 6.2, < 6.6.143 | 6.6.143 |
| linux/linux_kernel | ≥ 6.7, < 6.12.92 | 6.12.92 |
| linux/linux_kernel | ≥ 6.13, < 6.18.34 | 6.18.34 |
| linux/linux_kernel | ≥ 6.19, < 7.0.11 | 7.0.11 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |