PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23442 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 Segment Routing (SRv6) implementation. The function `__in6_dev_get()` can return NULL when a network device lacks IPv6 configuration, such as when the MTU is below `IPV6_MIN_MTU` or during `NETDEV_UNREGISTER` processing. Two SRv6 code paths—`seg6_hmac_validate_skb()` and `ipv6_srh_rcv()`—failed to validate the returned `idev` pointer before use, leading to potential kernel crashes. The vulnerability was resolved by adding explicit NULL checks in both functions. The issue affects Linux kernel versions from 4.10.1 through 6.12.82, 6.13 through 6.19.9, and pre-release 7.0-rc kernels. Patches are available via the stable kernel tree.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Linux system administrators, kernel maintainers, and network operators deploying SRv6 infrastructure.

Technical summary

The Linux kernel's SRv6 implementation in `seg6_hmac_validate_skb()` and `ipv6_srh_rcv()` calls `__in6_dev_get()` without checking for a NULL return. When a device has no IPv6 configuration (MTU too low or unregistered), this causes a NULL pointer dereference. The fix adds NULL checks before dereferencing `idev` in both functions.

Defensive priority

medium

Recommended defensive actions

  • Apply the latest stable kernel patches for affected versions (4.10.1–6.12.82, 6.13–6.19.9, and 7.0-rc series).
  • Verify kernel version and confirm patch presence via distribution security advisories.
  • Monitor systems for unexpected kernel panics or crashes on hosts processing SRv6 traffic.
  • Restrict untrusted local access where feasible, as exploitation requires local privileges per CVSS vector.

Evidence notes

CVE description confirms NULL pointer dereference in SRv6 paths. NVD CPE data specifies affected kernel version ranges. Multiple kernel.org stable commits tagged as patches. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields score 5.5 (MEDIUM). CWE-476 (NULL Pointer Dereference) assigned by NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23442 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23442

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23442 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23442

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0348fa0ada37cef7c6b5ab2a428bb2c6aee784e4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/06413793526251870e20402c39930804f14d59c0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/50352fc103928e10e8729abc79a0d05abef26c4d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/83d705d35e583cb1b1eacf196dfe7b77d442018e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a25853c9feea7bbf31d157ff6e004d2d3b4f7f13

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bc9843c39f9932a8b36efd1d362ea00bb88e4e78

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c5cedee5d97382176573bbe21e1724e737a5eb64

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.