CVE-2026-23304: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23304 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 routing subsystem, specifically in the ip6_rt_get_dev_rcu() function. It affects Linux kernel versions from 4.14 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7. The vulnerability was introduced by commit 4832c30d5458 and disclosed on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in ip6_rt_pcpu_alloc() → ip6_rt_get_dev_rcu(). The function l3mdev_master_dev_rcu() can return NULL when a slave network device is being un-slaved from a Virtual Routing and Forwarding (VRF) instance, but the fallback to the loopback device (loopback_dev) was inadvertently removed by commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). The vulnerable call chain is: vrf_process_v6_outbound → ip6_route_output_flags → fib6_rule_lookup → ip6_pol_route → ip6_rt_pcpu_alloc → ip6_rt_get_dev_rcu, where a NULL dereference occurs in the range [0x0000000000000108–0x000000000000010f] as confirmed by KASAN. The fix restores the explicit fallback to loopback_dev when l3mdev_master_dev_rcu() returns NULL (Red Hat Advisory).

Successful exploitation causes a kernel panic (NULL pointer dereference), resulting in a complete denial of service for the affected system. The impact is limited to availability — there is no confidentiality or integrity impact. A local user with network access capabilities can trigger this condition by performing VRF un-slaving operations while IPv6 traffic is actively being routed, making it particularly relevant in virtualized or containerized environments using VRF-based network isolation (Red Hat Advisory, Feedly).

1. Gain local access: Obtain a local user account or process execution on a Linux system running a vulnerable kernel version (4.14 through the affected ranges) with VRF networking configured.
2. Identify VRF configuration: Confirm that one or more network interfaces are enslaved to a VRF device using ip link show or ip vrf show.
3. Initiate IPv6 traffic: Start or ensure active IPv6 routing traffic is flowing through the VRF-enslaved interface (e.g., via ping6 or active network connections).
4. Trigger un-slaving race condition: While IPv6 traffic is being processed, remove the slave device from the VRF (e.g., ip link set <dev> nomaster), creating a race condition where l3mdev_master_dev_rcu() returns NULL during route allocation.
5. Kernel panic: The NULL pointer dereference in ip6_rt_get_dev_rcu() triggers a kernel panic, causing a system crash and denial of service (Red Hat Advisory).

• Logs: Kernel crash logs or dmesg output containing KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] and stack traces referencing ip6_rt_pcpu_alloc, ip6_pol_route, fib6_rule_lookup, ip6_route_output_flags, or vrf_process_v6_outbound.
• System Events: Unexpected system reboots or kernel panics on hosts with VRF networking enabled and active IPv6 traffic.
• Network: Sudden loss of IPv6 connectivity on systems using VRF configurations, particularly coinciding with VRF interface changes (ip link set <dev> nomaster commands in audit logs).
• Audit Logs: auditd records showing ip link or ip vrf commands executed around the time of a system crash, especially un-slaving operations on VRF-bound interfaces.

Apply the upstream kernel patches that restore the fallback to loopback_dev in ip6_rt_get_dev_rcu(). Fixed versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7. Patches are available via the stable kernel tree at git.kernel.org. As a temporary workaround, avoid performing VRF un-slaving operations while IPv6 traffic is actively being routed on the affected system. Distribution-specific updates have been issued by Red Hat, SUSE, Debian, and Amazon Linux 2023 (Red Hat Advisory, SUSE Advisory, Amazon Linux).

Red Hat assigned a Medium severity rating and published a CVE advisory shortly after disclosure. SUSE issued security update announcements (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing the vulnerability in their kernel packages. Debian issued multiple DSAs (DSA-6238-1, DSA-6243-1) and an LTS advisory (DLA-4561-1) covering this and related kernel fixes. Amazon Linux 2023 also released patches via ALAS advisories. No notable social media discussion or independent researcher commentary has been identified beyond standard vendor patch tracking (Red Hat Advisory, SUSE Advisory, Amazon Linux).