CVE-2026-89561

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL

check when reading idev->cnf.rpl_seg_enabled.

When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears

dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev

check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with

dev->ip6_ptr already NULL.

Reproduced by flooding the receiving interface with ping6 traffic while

flapping its MTU between 1500 and 1200:

BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070

Read of size 4 at addr 00000000000006b4 by task ping6/394

CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full)

Call Trace:

<IRQ>

kasan_report+0xc6/0x100

ipv6_rpl_srh_rcv+0xb3/0x1070

ip6_protocol_deliver_rcu+0x759/0x9a0

ip6_input_finish+0xa8/0x1b0

ip6_input+0xe1/0x490

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References