CVE-2026-68336

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the bonding driver when the system boots with the ipv6.disable=1 parameter. In this configuration, devconf all is not initialized because inet6 init() exits before addrconf init() is called. Despite IPv6 being disabled, the bond send validate() function continues to call bond ns send all(), which eventually leads to a NULL dereference of net->ipv6.devconf all within the ip6 pol route() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.