CVE-2026-23293: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23293 is a NULL pointer dereference vulnerability in the Linux kernel's VXLAN networking module, triggered when IPv6 is disabled at boot time via the ipv6.disable=1 kernel parameter. When the system boots with IPv6 disabled, the neighbor discovery table (nd_tbl) is never initialized by ndisc_init(); if an IPv6 packet is subsequently injected into a VXLAN interface, route_shortcircuit() calls neigh_lookup() on the uninitialized pointer, causing a kernel crash. The vulnerability affects Linux kernel versions from 3.12 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified under CWE-476 (NULL Pointer Dereference) and CWE-824 (Access of Uninitialized Pointer). When the kernel boots with ipv6.disable=1, inet6_init() exits early before ndisc_init() is called, leaving nd_tbl uninitialized (NULL). If a local user injects an IPv6 packet into a VXLAN interface, the vxlan_xmit() function invokes route_shortcircuit(), which in turn calls neigh_lookup() using the NULL nd_tbl pointer, resulting in a kernel oops at address 0x0000000000000380. The fix adds an early protocol check in route_shortcircuit() for ETH_P_IPV6; notably, ipv6_mod_enabled() cannot be used as a guard because VXLAN may be built-in even when IPv6 is compiled as a module (Red Hat CVE).

Successful exploitation results in a kernel NULL pointer dereference, causing an immediate system crash (kernel panic/oops) and a complete denial of service for all processes on the affected host. The impact is limited to availability — there is no confidentiality or integrity compromise. In virtualized or containerized environments using VXLAN overlays, a crash of the host kernel could affect all co-located workloads (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The attack vector is local (AV:L), requiring a low-privileged user with the ability to inject network packets into a VXLAN interface on a system booted with ipv6.disable=1. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing BUG: kernel NULL pointer dereference, address: 0000000000000380 with a call trace including neigh_lookup, vxlan_xmit, dev_hard_start_xmit, __dev_queue_xmit, and packet_sendmsg.
• Process: Unexpected system reboots or kernel panics on hosts running VXLAN interfaces with ipv6.disable=1 in kernel boot parameters.
• Network: Unusual IPv6 packets (EtherType 0x86DD) arriving at or being injected into VXLAN tunnel interfaces on systems where IPv6 is disabled.

The primary remediation is to update to a patched kernel version: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 and later. Patches are available via upstream kernel stable commits and have been incorporated into distributions including SUSE, Debian, Amazon Linux 2023, and others. As a workaround, administrators can avoid booting with ipv6.disable=1 if IPv6 is not strictly required, or restrict local user access to VXLAN interfaces to prevent injection of IPv6 packets on affected systems (Red Hat CVE, SUSE Advisory, Amazon Linux).