CVE-2026-64569 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining and securing Linux-based systems, and security teams should be aware of this vulnerability. They should verify and apply patches, restrict access to RTM_GETROUTE functionality, and monitor system logs for potential denial of service attempts. Operators of Linux-based systems and platforms are also impacted, requiring coordination with vendors for patching and mitigation efforts. Vulnerability management and security teams need to prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management processes should be reviewed to ensure timely detection and remediation of exposed assets. Monitoring, detection, and log review for exposed assets that need extra review are crucial. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented are essential steps. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. The vulnerability management process should be updated to include source tracking and regular review of affected scope, severity, and vendor guidance. Security teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. The asset inventory should be reviewed to identify potentially affected systems. Change management processes should be updated to prioritize patching of affected systems. Monitoring and detection capabilities should be reviewed to ensure timely detection of potential attacks. Logs should be reviewed for signs of exploitation attempts. Exceptions should be tracked, and remediated assets should be retested before closing the item. Evidence of remediation should be documented. Compensating controls should be reviewed and updated as necessary. The vulnerability should be tracked through source tracking to ensure that all affected systems are identified and remediated. The security team should also review the CVE record and

Technical summary

The vulnerability exists in the Linux kernel's mpls_valid_fib_dump_req() function when CONFIG_INET is not set. The function does not check if the RTA_OIF attribute is present before passing it to nla_get_u32(), leading to a NULL dereference. This can be triggered by an unprivileged user through an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF. The issue allows for a potential denial of service.

Defensive priority

This vulnerability allows an unprivileged user to trigger a NULL dereference in the Linux kernel's mpls_valid_fib_dump_req() function, which could potentially lead to a denial of service.

Recommended defensive actions

• Verify and apply the provided patches to the Linux kernel
• Restrict access to the RTM_GETROUTE functionality to privileged users
• Monitor system logs for potential denial of service attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability exists in the Linux kernel when CONFIG_INET is not set. The mpls_valid_fib_dump_req() function does not check if the RTA_OIF attribute is present before passing it to nla_get_u32(), leading to a NULL dereference. This can be triggered by an unprivileged user through an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF.

Official resources