All vulnerabilities
CVE-2026-98379

Linux: netfilter: ip6t_rpfilter: reject routes without inet6_dev

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1681ab6dd1271f2f36047490793b78b1848bbcc9Also 65487e9e99431ffcf05024a817f51ee4e3bd9b47, 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40 and 2 moreCVE List
Published9 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1681ab6dd1271f2f36047490793b78b1848bbcc9LinuxCVE List
  • 65487e9e99431ffcf05024a817f51ee4e3bd9b47LinuxCVE List
  • 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40LinuxCVE List
  • 3a7384bc2e66217c9a01a392281334f4423740a0LinuxCVE List
  • 1b9b5323725e458906c7620a3bc10398b51ad954LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rpfilter: reject routes without inet6_dev

ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects in the FIB. An unprivileged user can construct this state with rtnetlink in a private user and network namespace, then trigger a NULL dereference through an IPv6 rpfilter lookup:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) Call Trace: ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316) nf_hook_slow (net/netfilter/core.c:619) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6216) process_backlog (net/core/dev.c:6680) __napi_poll (net/core/dev.c:7739) net_rx_action (net/core/dev.c:7959) handle_softirqs (kernel/softirq.c:622) do_softirq.part.0 (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:450) __dev_queue_xmit (net/core/dev.c:4913) packet_sendmsg (net/packet/af_packet.c:3139) __sys_sendto (net/socket.c:2252) __x64_sys_sendto (net/socket.c:2259) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

Reject routes without an inet6_dev immediately after lookup. Such routes are not eligible for reverse-path filtering, and the check protects all later rt6i_idev dereferences.

Text from CVE List

Affected versions 18

  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before f4de78756b0fddbd125b2b1b77c74f2eccc8e977CVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before 1681ab6dd1271f2f36047490793b78b1848bbcc9CVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before 65487e9e99431ffcf05024a817f51ee4e3bd9b47CVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before f49da48bd679cfee646d6a40dd02b1933de577d1CVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40CVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before eafe081ea77d25b5c8e601680671b4ecb4520e7dCVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before 3a7384bc2e66217c9a01a392281334f4423740a0CVE List
  • Linuxaffected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 before 1b9b5323725e458906c7620a3bc10398b51ad954CVE List
  • Linuxaffected: 3.3CVE List
  • Linuxunaffected: all versions before 3.3CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8