CVE-2026-23439 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on the Linux kernel should be aware of this vulnerability and take steps to mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The udp_sock_create6 function in the Linux kernel returns 0 without creating a socket when CONFIG_IPV6 is disabled. This leads to a NULL pointer dereference in callers like fou_create. The vulnerability has been resolved by making udp_sock_create6 return -EPFNOSUPPORT instead. This change ensures that callers correctly handle the error and take their error paths, preventing the NULL pointer dereference. Affected product deployments should be reviewed, and owners should be assigned for follow-up.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch to make udp_sock_create6 return -EPFNOSUPPORT
• Verify that CONFIG_IPV6 is properly configured
• Monitor for potential NULL pointer dereferences
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by making udp_sock_create6 return -EPFNOSUPPORT. The captured NULL deref crash shows a NULL pointer dereference in fou_nl_add_doit. This issue arises when CONFIG_IPV6 is disabled, and udp_sock_create6 returns 0 without creating a socket, leading to a NULL pointer dereference in callers like fou_create. To verify, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review.

Official resources