CVE-2026-23293: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23293 is a NULL pointer dereference vulnerability in the Linux kernel's VXLAN networking module, triggered when IPv6 is disabled at boot time via the ipv6.disable=1 kernel parameter. When the system boots with IPv6 disabled, the neighbor discovery table (nd_tbl) is never initialized by ndisc_init(); if an IPv6 packet is subsequently injected into a VXLAN interface, route_shortcircuit() calls neigh_lookup() on the uninitialized pointer, causing a kernel crash. The vulnerability affects Linux kernel versions from 3.12 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified under CWE-476 (NULL Pointer Dereference) and CWE-824 (Access of Uninitialized Pointer). When the kernel boots with ipv6.disable=1, inet6_init() exits early before ndisc_init() is called, leaving nd_tbl uninitialized (NULL). If a local user injects an IPv6 packet into a VXLAN interface, the vxlan_xmit() function invokes route_shortcircuit(), which in turn calls neigh_lookup() using the NULL nd_tbl pointer, resulting in a kernel oops at address 0x0000000000000380. The fix adds an early protocol check in route_shortcircuit() for ETH_P_IPV6; notably, ipv6_mod_enabled() cannot be used as a guard because VXLAN may be built-in even when IPv6 is compiled as a module (Red Hat CVE).

Successful exploitation results in a kernel NULL pointer dereference, causing an immediate system crash (kernel panic/oops) and a complete denial of service for all processes on the affected host. The impact is limited to availability — there is no confidentiality or integrity compromise. In virtualized or containerized environments using VXLAN overlays, a crash of the host kernel could affect all co-located workloads (Red Hat CVE, Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing BUG: kernel NULL pointer dereference, address: 0000000000000380 with a call trace including neigh_lookup, vxlan_xmit, dev_hard_start_xmit, __dev_queue_xmit, and packet_sendmsg.
• Process: Unexpected system reboots or kernel panics on hosts running VXLAN interfaces with ipv6.disable=1 in kernel boot parameters.
• Network: Unusual IPv6 packets (EtherType 0x86DD) arriving at or being injected into VXLAN tunnel interfaces on systems where IPv6 is disabled.

The primary remediation is to update to a patched kernel version: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 and later. Patches are available via upstream kernel stable commits and have been incorporated into distributions including SUSE, Debian, Amazon Linux 2023, and others. As a workaround, administrators can avoid booting with ipv6.disable=1 if IPv6 is not strictly required, or restrict local user access to VXLAN interfaces to prevent injection of IPv6 packets on affected systems (Red Hat CVE, SUSE Advisory, Amazon Linux).