CVE-2026-53012

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: fix IPv6 route referencing IPv4 nexthop

syzbot reported a panic [1] [2].

When an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag

of all groups containing this nexthop is not updated. This is because

nh_group_v4_update is only called when replacing AF_INET to AF_INET6,

but the reverse direction (AF_INET6 to AF_INET) is missed.

This allows a stale has_v4=false to bypass fib6_check_nexthop, causing

IPv6 routes to be attached to groups that effectively contain only AF_INET

members. Subsequent route lookups then call nexthop_fib6_nh() which

returns NULL for the AF_INET member, leading to a NULL pointer

dereference.

Fix by calling nh_group_v4_update whenever the family changes, not just

AF_INET to AF_INET6.

Reproducer:

# AF_INET6 blackhole

ip -6 nexthop add id 1 blackhole

# group with has_v4=false

ip nexthop add id 100 group 1

# replace with AF_INET (no -6), has_v4 stays false

ip nexthop r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References