CVE-2026-23304

Vulnerability

Description

In the Linux kernel, the function ip6_rt_get_dev_rcu() can return NULL when called from ip6_rt_pcpu_alloc() if the slave device is being removed from a VRF. This occurs because l3mdev_master_dev_rcu() returns NULL in that race condition, and the fallback to the loopback device was removed by commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). The fix commits [1][2][3][4] reintroduce the fallback to prevent the NULL pointer dereference.

Exploitation

The vulnerability is triggered during VRF outbound processing when a slave device is being un-slaved. The call path is vrf_process_v6_outbound -> ip6_route_output_flags -> fib6_rule_lookup -> ip6_pol_route -> ip6_rt_pcpu_alloc, where the NULL pointer dereference occurs. An attacker with the ability to influence VRF configuration or network namespaces could potentially trigger this race condition.

Impact

Successful exploitation results in a NULL pointer dereference, causing a kernel panic and denial of service. The KASAN report confirms the null-ptr-deref in the range [0x0000000000000108-0x000000000000010f].

Mitigation

The fix reintroduces the fallback to the loopback device when l3mdev_master_dev_rcu() returns NULL. The patch has been applied to stable kernel trees as seen in commits [1], [2], [3], and [4]. Users should update to the latest stable kernel versions containing these fixes.