PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23381 Linux CVE debrief

A NULL pointer dereference vulnerability was found in the Linux kernel when IPv6 is disabled. The issue occurs when the 'ipv6.disable=1' parameter is used during boot, preventing the initialization of nd_tbl. When neigh_suppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, the br_do_suppress_nd() function will dereference ipv6_stub->nd_tbl, which is NULL, causing a kernel NULL pointer dereference. This issue can impact Linux kernel deployments where IPv6 is disabled and neigh_suppress is enabled.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

Users of the Linux kernel who may be affected by this vulnerability should take action to mitigate the issue. This includes administrators of Linux-based systems, developers using the Linux kernel, and users of systems that rely on the Linux kernel. They should review official advisories, apply patches, and monitor for potential impacts.

Technical summary

The vulnerability is caused by a NULL pointer dereference in the br_do_suppress_nd() function when IPv6 is disabled. The nd_tbl is not initialized when IPv6 is disabled, and the function attempts to access it, resulting in a kernel NULL pointer dereference. The issue can be resolved by replacing the IS_ENABLED(IPV6) call with ipv6_mod_enabled() in the callers, effectively disabling NS/NA suppression when IPv6 is disabled. This change prevents the NULL pointer dereference.

Defensive priority

Medium

Recommended defensive actions

  • Apply patches provided by the Linux kernel maintainers
  • Disable neigh_suppress if not required
  • Monitor for ICMPv6 Neighbor Discovery packets
  • Verify IPv6 is not disabled when required
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-03-25T11:16:38.160Z and was last modified on 2026-07-14T13:18:31.910Z. The NVD entry is currently Modified. This vulnerability affects Linux kernel deployments where IPv6 is disabled. Defenders should verify if affected systems exist in their environment and review official advisories for scope and severity. Evidence is limited to public CVE and NVD information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23381 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23381

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23381 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23381

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/20ef5c25422f97dd09d751e5ae6c18406cdc78e6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/33dec6f10777d5a8f71c0a200f690da5ae3c2e55

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7a894eb5de246d79f13105c55a67381039a24d44

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a12cdaa3375f0bd3c8f4e564be7c143529abfe5b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a5c56e65b685360dd3f2278aeff8c21061feb665

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a9d712ccfeef737c0e700a4b5b98f310e07b6b60

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aa73deb3b6b730ec280d45b3f423bfa9e17bc122

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.