CVE-2026-23300

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop

When a standalone IPv6 nexthop object is created with a loopback device

(e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies

it as a reject route. This is because nexthop objects have no destination

prefix (fc_dst=::), causing fib6_is_reject() to match any loopback

nexthop. The reject path skips fib_nh_common_init(), leaving

nhc_pcpu_rth_output unallocated. If an IPv4 route later references this

nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and

panics.

Simplify the check in fib6_nh_init() to only match explicit reject

routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback

promotion heuristic in fib6_is_reject() is handled separately by

ip6_route_info_create_nh(). After this change, the three cases behave

as follows:

1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"):

RTF_R

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References