CVE-2026-64538

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and

dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown()

clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has

released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and

oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(),

but this re-fetch is unguarded; nexthop-backed routes survive

addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is

nulled.

Return 0 when idev is NULL, matching rt6_mtu_change_route() and the

fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in

fib6_mtu().").

Oops: general protection fault, ... KASAN: null-ptr-deref in range

[0x00000000000002a8-0x00000000000002af]

RIP: 0010:fib6_nh_mtu_change+0x203/0x990

rt6_mtu_change_route+0x141/0x1d0

__fib6_clean_all+0xd0/0x160

r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References