CVE-2026-98379

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rpfilter: reject routes without inet6_dev

ip6_route_lookup() can return an error-free route whose rt6i_idev is

NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears

down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects

in the FIB. An unprivileged user can construct this state with rtnetlink

in a private user and network namespace, then trigger a NULL dereference

through an IPv6 rpfilter lookup:

Oops: general protection fault, probably for non-canonical address

0xdffffc0000000000

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)

Call Trace:

ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)

nf_hook_slow (net/netfilter/core.c:619)

ipv6_rcv (net/ipv6/ip6_input.c:351)

__netif_receive_skb_one_core (net/core/dev.c:6216)

process_backlog (net/core/dev.c:6680)

__napi_pol

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References