CVE-2026-64116

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the Linux kernel when processing an IOAM Hop-by-Hop option. The function ipv6 hop ioam() accesses in6 dev get(skb->dev)->cnf.ioam6 enabled without validating the returned idev pointer. During interface teardown, addrconf ifdown() can concurrently clear dev->ip6 ptr via RCU (Read-Copy-Update, a synchronization mechanism), causing in6 dev get() to return NULL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.