CVE-2026-80646 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
dev_get_by_index_rcu() could return NULL if the original physical device is unregistered.
Found by Sashiko.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel contains a critical flaw within its IPv6 networking subsystem, specifically located in the function __in6_dev_stats_get(). This vulnerability arises from an insufficient null pointer check when handling network interface statistics retrieval operations. The core issue stems from the behavior of dev_get_by_index_rcu(), a helper function used to retrieve a reference to a network device based on its index while holding read-copy-update locks for concurrency safety. Under normal circumstances, this function returns a valid pointer to the requested net_device structure. However, if the underlying physical device has been unregistered or is in the process of being removed from the system, dev_get_by_index_rcu() may return NULL instead of a valid object reference.
The technical flaw lies in the subsequent use of this potentially null pointer without adequate validation. When __in6_dev_stats_get() receives a NULL result from dev_get_by_index_rcu(), it proceeds to dereference that pointer to access device statistics data structures. This unconditional dereferencing leads to an invalid memory access, triggering a kernel panic or system crash due to a NULL pointer dereference exception. The vulnerability is particularly dangerous because network interface state changes are common in dynamic environments where interfaces are frequently added and removed, such as in virtualized cloud infrastructure or container orchestration systems like Kubernetes. An attacker who can trigger rapid interface creation and deletion cycles could potentially exploit this race condition to cause denial of service against the host system.
From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference vulnerabilities where software fails to check for null pointers before using them. In terms of attack vectors, it relates to ATT&CK technique T1053 Scheduled Task/Job, as an attacker might schedule repeated interface operations to increase the probability of hitting the race window. The operational impact is severe, resulting in complete system unavailability until a reboot occurs since kernel panics cannot be recovered from gracefully without restarting affected services or the entire host machine.
Mitigation strategies involve applying vendor-provided security patches that update the Linux kernel version to include fixes for this specific issue. System administrators should monitor for updates related to IPv6 networking components and ensure timely application of these patches in production environments. Additionally, defensive coding practices suggest implementing robust null checks before any pointer dereference operations involving dynamically allocated or looked-up structures. For organizations running vulnerable versions, temporary workarounds might include limiting the rate at which network interfaces are created and destroyed through configuration policies to reduce exposure windows until permanent fixes can be deployed.