CVE-2026-23381

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never

initialized because inet6_init() exits before ndisc_init() is called

which initializes it. Then, if neigh_suppress is enabled and an ICMPv6

Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will

dereference ipv6_stub->nd_tbl which is NULL, passing it to

neigh_lookup(). This causes a kernel NULL pointer dereference.

BUG: kernel NULL pointer dereference, address: 0000000000000268

Oops: 0000 [#1] PREEMPT SMP NOPTI

[...]

RIP: 0010:neigh_lookup+0x16/0xe0

[...]

Call Trace:

<IRQ>

? neigh_lookup+0x16/0xe0

br_do_suppress_nd+0x160/0x290 [bridge]

br_handle_frame_finish+0x500/0x620 [bridge]

br_handle_frame+0x353/0x440 [bridge]

__netif_receive_skb_core.constprop.0+0x298/0x1110

__netif_receive_skb_one_core+0x3d/0xa0

process_backlog+0xa0/0x140

__napi_poll+0x2c/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References