CVE-2026-64538

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A null-pointer dereference exists in the IPv6 implementation. The function fib6 nh mtu change() re-fetches idev using in6 dev get(arg->dev) and accesses idev->cnf.mtu6 without verifying if idev is NULL. This occurs because addrconf ifdown() clears dev->ip6 ptr after rt6 disable ip() releases tb6 lock, allowing a Router Advertisement (RA)-driven MTU walk to encounter a NULL idev, leading to a system oops (kernel crash). While the caller rt6 mtu change route() performs its own check, the re-fetch within fib6 nh mtu change() remains unguarded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.