CVE-2026-23300: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23300 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 nexthop handling that can cause a kernel panic (denial of service). When a standalone IPv6 nexthop object is created using a loopback device (e.g., ip -6 nexthop add id 100 dev lo), fib6_nh_init() misclassifies it as a reject route, causing fib_nh_common_init() to be skipped and leaving nhc_pcpu_rth_output unallocated. If an IPv4 route subsequently references this nexthop, __mkroute_output() dereferences the NULL pointer and panics. The vulnerability affects Linux kernel versions from 5.3 through multiple stable branches up to 6.19.x and 7.0-rc releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing initialization of the nhc_pcpu_rth_output resource (CWE-909) leading to a NULL pointer dereference (CWE-476) in the kernel's IPv6 routing subsystem. The function fib6_is_reject() incorrectly matches any loopback nexthop when no destination prefix is set (fc_dst=::), causing the reject code path to be taken for standalone nexthop objects — a path that intentionally skips fib_nh_common_init(). The fix modifies fib6_nh_init() to check only for the explicit RTF_REJECT flag rather than calling fib6_is_reject(), ensuring fib_nh_common_init() is called and nhc_pcpu_rth_output is properly allocated for standalone nexthop objects. Exploitation requires local access with network configuration privileges (e.g., CAP_NET_ADMIN) and a two-step trigger: first creating the malformed nexthop, then adding an IPv4 route referencing it (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a kernel panic, causing a complete system crash and denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. A local user with network configuration privileges can crash the affected system, potentially disrupting all services running on it; however, there is no evidence of lateral movement capability or data exposure risk associated with this vulnerability (Red Hat Advisory, Red Hat Bugzilla).

1. Gain local access: Obtain a local shell on the target system with network configuration privileges (e.g., CAP_NET_ADMIN capability or root access).
2. Create a malformed IPv6 nexthop: Execute ip -6 nexthop add id 100 dev lo to create a standalone IPv6 nexthop object on the loopback interface. This causes fib6_nh_init() to misclassify it as a reject route, skipping fib_nh_common_init() and leaving nhc_pcpu_rth_output as NULL.
3. Add an IPv4 route referencing the nexthop: Execute a command such as ip route add <prefix> nhid 100 to create an IPv4 route that references the malformed nexthop object.
4. Trigger the kernel panic: When the kernel processes routing for the IPv4 route, __mkroute_output() dereferences the NULL nhc_pcpu_rth_output pointer, causing an immediate kernel panic and system crash (Red Hat Bugzilla, Red Hat Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing __mkroute_output, fib6_nh_init, or nhc_pcpu_rth_output with a NULL pointer dereference trace.
• Logs: System crash dumps (kdump/vmcore) generated around the time of unexpected reboots, with stack traces involving IPv6 nexthop and IPv4 routing functions.
• Process/Command History: Shell history or audit logs showing execution of ip -6 nexthop add id <N> dev lo followed by ip route add commands referencing that nexthop ID by a non-root user with CAP_NET_ADMIN.
• Network: Unexpected system reboots or availability interruptions correlated with IPv6 nexthop configuration changes visible in ip nexthop show output prior to the crash.

Apply the upstream kernel patches available via the stable kernel tree for the affected branches. Fixed versions include 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and later. Patches are available from the Linux stable kernel repository (git.kernel.org) and have been incorporated into Red Hat, SUSE, Debian, and Amazon Linux 2023 advisories. As a workaround where patching is not immediately possible, restrict CAP_NET_ADMIN privileges to trusted users only to prevent unprivileged creation of nexthop objects. Monitor for and apply updates from your Linux distribution vendor (Red Hat Advisory, Microsoft MSRC).