CVE-2026-64542

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ndisc: fix NULL deref in accept_untracked_na()

accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)

and dereferences idev->cnf.accept_untracked_na without a NULL check,

even though its only caller ndisc_recv_na() already fetched and

NULL-checked idev for the same device.

Both reads of dev->ip6_ptr run in the same RCU read-side critical

section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr

between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()

without the synchronize_net() that orders the unregister path, so the

re-fetch returns NULL and oopses:

BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)

Read of size 4 at addr 0000000000000364

Call Trace:

<IRQ>

ndisc_recv_na (net/ipv6/ndisc.c:974)

icmpv6_rcv (net/ipv6/icmp.c:1193)

ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)

ip6_input_finish (net/ipv6/ip6_input.c:534)

ip6_input (net

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References