CVE-2026-23381: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23381 is a NULL pointer dereference vulnerability in the Linux kernel's bridge networking subsystem, specifically in the br_do_suppress_nd() function. When the kernel is booted with the ipv6.disable=1 parameter, the neighbor discovery table (nd_tbl) is never initialized; if neighbor suppression (neigh_suppress) is also enabled on a bridge interface and an ICMPv6 Neighbor Discovery packet arrives, the kernel dereferences a NULL pointer in ipv6_stub->nd_tbl, causing a system crash. The vulnerability affects Linux kernel versions from 4.15 through multiple stable branches up to 6.12.76, 6.18.16, and 6.19.6, among others. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-824 (Access of Uninitialized Pointer). When ipv6.disable=1 is set at boot, inet6_init() exits before ndisc_init() is called, leaving ipv6_stub->nd_tbl as NULL. The bridge code in br_do_suppress_nd() incorrectly uses IS_ENABLED(CONFIG_IPV6) — a compile-time check — rather than the runtime check ipv6_mod_enabled(), so it proceeds to pass the NULL nd_tbl pointer to neigh_lookup(), triggering a kernel oops in the IRQ context. The fix replaces the compile-time IS_ENABLED(IPV6) guard with the runtime ipv6_mod_enabled() call in the relevant callers, effectively disabling NS/NA suppression when IPv6 is disabled at runtime (Red Hat Advisory, Kernel Patch).

Successful exploitation causes an immediate kernel NULL pointer dereference and system panic (denial of service), crashing the affected host entirely. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. The crash is triggered from the network receive interrupt context, meaning a remote attacker on the same network segment can send a crafted ICMPv6 Neighbor Discovery packet to crash a vulnerable bridge host without any authentication, provided the specific preconditions are met (Red Hat Advisory, Feedly).

1. Identify vulnerable targets: Scan for Linux hosts acting as network bridges (e.g., hypervisors, container hosts, or network appliances) that are booted with ipv6.disable=1 and have bridge interfaces with neigh_suppress enabled (verifiable via bridge link show or system configuration files).
2. Confirm preconditions: Verify that the target kernel version falls within the affected range (e.g., 4.15–6.12.76, 6.7–6.18.16, or 6.13–6.19.6) and that the bridge interface is reachable from the attacker's network segment.
3. Craft ICMPv6 Neighbor Discovery packet: Construct an ICMPv6 Neighbor Solicitation (NS) or Neighbor Advertisement (NA) packet using a tool such as scapy or ndisc6, targeting the bridge interface's MAC/IP.
4. Send the packet: Transmit the crafted ICMPv6 packet to the bridge interface. When the bridge processes the packet with neigh_suppress enabled, br_do_suppress_nd() is invoked, dereferences the NULL nd_tbl, and triggers a kernel panic, crashing the host (Red Hat Advisory, Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing BUG: kernel NULL pointer dereference, address: 0000000000000268 and a call trace including neigh_lookup, br_do_suppress_nd, br_handle_frame_finish, and br_handle_frame.
• Logs: System crash/reboot events logged in /var/log/syslog or systemd journal (journalctl -b -1) immediately following receipt of ICMPv6 traffic on a bridge interface.
• Network: Unexpected ICMPv6 Neighbor Solicitation or Neighbor Advertisement packets arriving on bridge interfaces from external or untrusted network segments, particularly if the host is configured with ipv6.disable=1.
• Process/System: Unexpected system reboots or kernel panic dumps (vmcore files) in /var/crash/ or configured kdump directories on bridge-enabled hosts (Red Hat Advisory).

Apply the patched kernel versions released across all affected stable branches: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or 7.0-rc3+. Patches are available via git.kernel.org and have been incorporated into downstream distributions including SUSE, Amazon Linux 2023, Debian, and Oracle Linux (Red Hat Advisory, SUSE Advisory). As a temporary workaround until patching is complete, disable neighbor suppression on bridge interfaces (bridge link set dev <iface> neigh_suppress off) or avoid booting with ipv6.disable=1 on systems where bridge neighbor suppression is required (Feedly).

Red Hat tracked the vulnerability via Bugzilla (bug #2451220) and published a CVE advisory shortly after disclosure. Microsoft also referenced the CVE in their security guidance portal, reflecting its relevance to Azure Linux (AZL3 kernel 6.6.126.1-1). Multiple downstream Linux distributions — including SUSE, Amazon Linux, Debian, and Oracle Linux — issued security advisories and updated kernel packages. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (Red Hat Advisory, SUSE Advisory).