CVE-2026-64542

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the IPv6 Neighbor Discovery (NDISC) component. The function accept untracked na() re-fetches the inet6 dev using in6 dev get(dev) and accesses idev->cnf.accept untracked na without verifying if the result is NULL. Although the caller function ndisc recv na() performs a NULL check, a concurrent call to addrconf ifdown()—triggered by lowering the MTU below IPV6 MIN MTU—can clear dev->ip6 ptr between the two reads. This sequence leads to a system oops. This issue is reachable by an unprivileged user through a network namespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.