CVE-2026-89561 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux-based systems, particularly those who manage or maintain Linux kernel deployments, should review and apply patches to prevent potential system crashes or instability and denial-of-service attacks.

Why it matters

A null pointer dereference vulnerability in the Linux kernel's IPv6 implementation requires attention from Linux kernel developers, network administrators, and security teams. The vulnerability can cause system crashes or instability and may be exploited for denial-of-service attacks. Verification of kernel version and patch application, as well as monitoring of network traffic and system logs, are necessary to ensure system security.

• Potential system crashes or instability due to null pointer dereferences.
• Possible denial-of-service (DoS) attacks through exploitation of this vulnerability.
• Verification of kernel version and patch application is necessary to ensure system security.
• Monitoring of network traffic and system logs is recommended to detect potential exploitation attempts.

Technical summary

The vulnerability occurs in the Linux kernel's IPv6 implementation, specifically in the ipv6_rpl_srh_rcv() function. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL, causing a null pointer dereference. The fix involves adding a NULL check for idev in ipv6_rthdr_rcv() before calling ipv6_rpl_srh_rcv() or ipv6_srh_rcv(). This change ensures that the packet is dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to ensure the vulnerability is fixed.
• Monitor network traffic and system logs for potential exploitation attempts.
• Verify that affected systems are updated with the latest kernel version.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by adding a NULL check for idev in ipv6_rthdr_rcv() before calling ipv6_rpl_srh_rcv() or ipv6_srh_rcv(). This change ensures that the packet is dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths. The fix was applied to prevent null pointer dereferences when the device's MTU drops below IPV6_MIN_MTU, causing addrconf_ifdown() to clear dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.