CVE-2026-89561

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix NULL dereference of idev in ipv6 rpl srh rcv()

ipv6 rpl srh rcv() dereferences idev from in6 dev get() without a NULL check when reading idev->cnf.rpl seg enabled.

When the device's MTU drops below IPV6 MIN MTU, addrconf ifdown() clears dev->ip6 ptr through RCU INIT POINTER(). A packet that passed the idev check in ip6 rcv core() can then reach ipv6 rpl srh rcv() with dev->ip6 ptr already NULL.

Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200:

BUG: KASAN: null-ptr-deref in ipv6 rpl srh rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394

CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: kasan report+0xc6/0x100 ipv6 rpl srh rcv+0xb3/0x1070 ip6 protocol deliver rcu+0x759/0x9a0 ip6 input finish+0xa8/0x1b0 ip6 input+0xe1/0x490 ipv6 rcv+0x33d/0x460 netif receive skb one core+0xd6/0x130 process backlog+0x2cc/0xa00 napi poll.constprop.0+0x56/0x270 net rx action+0x327/0x730 handle softirqs+0x11e/0x630 do softirq+0xb3/0xf0

Both ipv6 rpl srh rcv() and ipv6 srh rcv() are called only from ipv6 rthdr rcv(), which already has an idev lookup.

Fix the NULL dereference on the RPL path by checking idev in ipv6 rthdr rcv(), before it calls either function. The callees take idev as an argument and no longer call in6 dev get(), so the packet is now dropped in one place, with SKB DROP REASON IPV6DISABLED on both paths.