CVE-2026-23293

Vulnerability

CVE-2026-23293 is a NULL pointer dereference vulnerability in the Linux kernel's VXLAN implementation. When the kernel is booted with the ipv6.disable=1 parameter, the IPv6 neighbor discovery table (nd_tbl) is never initialized because inet6_init() exits before ndisc_init() is called. If an IPv6 packet is then injected into a VXLAN interface, the route_shortcircuit() function calls neigh_lookup(), which dereferences the uninitialized nd_tbl, leading to a kernel crash.

Exploitation

An attacker can trigger this vulnerability by sending a crafted IPv6 packet to a VXLAN interface on a system that has IPv6 disabled at boot. No authentication is required, and the attack can be performed remotely if the VXLAN interface is reachable. The crash occurs in the vxlan_xmit function, as shown in the kernel panic trace.

Impact

Successful exploitation results in a denial of service (DoS) due to a kernel NULL pointer dereference, causing a system crash or reboot. The vulnerability does not allow privilege escalation or code execution, but it can be used to disrupt network services.

Mitigation

The fix adds an early check in route_shortcircuit() to return immediately when the protocol is ETH_P_IPV6 and IPv6 is disabled. The patch has been applied to the stable kernel tree [1][2][3][4]. Users should update their kernel to a version containing the fix. As a workaround, ensure IPv6 is enabled or filter IPv6 traffic at the network boundary.