CVE-2026-64569

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed

attribute table itself instead of calling ip_valid_fib_dump_req(). The

RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is

present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no

RTA_OIF hits a NULL dereference.

RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without

CAP_NET_ADMIN, so an unprivileged user can trigger it.

Oops: general protection fault, probably for non-canonical address

0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)

Call Trace:

mpls_dump_routes (net/mpls/af_mpls.c:2236)

netlink_dump (net/netlink/af_netlink.c:2331)

__netlink_dump_start (net/netlink/af_netlink.c:2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References