CVE-2026-64116 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Reported by Sashiko:
The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option.
Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical null pointer dereference flaw in the Linux kernel's IPv6 implementation specifically within the ioam (Ingress OAM) handling mechanism. This issue occurs in the ipv6_hop_ioam() function which processes Hop-by-Hop options for IPv6 packets containing IOAM data. The problem stems from inadequate validation of the interface device pointer returned by __in6_dev_get() function, creating a race condition scenario that can lead to system crashes and potential denial of service conditions.
The technical flaw manifests when the addrconf_ifdown() function executes concurrently with packet processing operations. During interface teardown, addrconf_ifdown() clears the dev->ip6_ptr field through RCU (Read-Copy-Update) mechanisms, which can result in __in6_dev_get() returning a NULL pointer. When ipv6_hop_ioam() attempts to access the ioam6_enabled field of this NULL pointer without proper validation, it triggers an immediate system crash due to null pointer dereference. This race condition vulnerability specifically affects the IPv6 IOAM processing path where packets are being processed while network interfaces are being shut down.
The operational impact of this vulnerability extends beyond simple system crashes as it can be exploited by malicious actors to perform denial of service attacks against IPv6 enabled systems. The vulnerability is particularly concerning because it operates at the kernel level where such flaws can compromise entire network infrastructure. Systems running Linux kernels with IPv6 IOAM functionality enabled are at risk, especially in environments where network interfaces undergo frequent changes or where automated network management tools might trigger interface down events during packet processing. The SKB_DROP_REASON_IPV6DISABLED error code mentioned in the fix indicates that the system should properly drop packets rather than crashing when encountering this condition.
The mitigation strategy involves implementing proper NULL pointer validation before accessing device configuration fields within the ipv6_hop_ioam() function. This approach aligns with CWE-476 which specifically addresses null pointer dereference vulnerabilities and follows established security practices for race condition handling. The fix demonstrates adherence to secure coding principles by ensuring that all pointer accesses are validated before dereferencing, preventing potential exploitation paths that could lead to system compromise. This vulnerability also relates to ATT&CK technique T1499.004 which covers network denial of service attacks through kernel-level manipulation, emphasizing the importance of robust input validation in kernel space operations.