CVE-2026-64116 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.
A vulnerability in the Linux kernel's IPv6 IOAM (In-situ Operations, Administration, and Maintenance) processing can lead to a NULL pointer dereference. This issue arises in the function 'ipv6_hop_ioam()', which accesses the IOAM configuration of a network device without first verifying that the device is valid. During the teardown of network interfaces, the IOAM configuration can be cleared, allowing 'ipv6_hop_ioam()' to attempt to read a NULL value. This flaw has been addressed by adding a NULL check for the device pointer, ensuring that the IOAM processing only occurs if the device is properly configured.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the kernel can be found in the documentation for the specific Linux distribution in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/09cbfd4b81ae90963dadb1de99b63b702e73290a | kernel.org | Patch |
| https://git.kernel.org/stable/c/1dca7e491f070ac49b3d934f16ee953a53b37f38 | kernel.org | Patch |
| https://git.kernel.org/stable/c/902daac307eb7e1955ce05b071950f3cba88c963 | kernel.org | Patch |
| https://git.kernel.org/stable/c/abdd03229414b5a52943b65a60f34b84cea5ac59 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c7e8971abd70e9d022f1c251ba2508f8dc7f2db8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cf75eb6617042c8cff6112daeed7791809fc9dd2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.15, < 5.15.210 >= 5.16, < 6.1.176 >= 6.2, < 6.6.143 >= 6.7, < 6.12.92 >= 6.13, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |