CVE-2026-89561

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the ipv6 rpl srh rcv() function when it accesses the idev variable obtained from in6 dev get() without a proper NULL check while reading idev->cnf.rpl seg enabled. This issue is triggered when a device's Maximum Transmission Unit (MTU) drops below the minimum IPv6 MTU, causing addrconf ifdown() to clear dev->ip6 ptr. Consequently, a packet that previously passed the idev check in ip6 rcv core() can reach ipv6 rpl srh rcv() while dev->ip6 ptr is already NULL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.