CVE-2026-98379: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98379 is a NULL pointer dereference vulnerability in the Linux kernel's netfilter ip6t_rpfilter module that allows an unprivileged local user to crash the kernel (Denial of Service). The flaw was published on October 9, 2026, and affects the Linux kernel from version 3.3 onward, with fixes backported to stable branches (5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5). Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.157.1-1 is also listed as affected. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in net/ipv6/netfilter/ip6t_rpfilter.c at line 75. The ip6_route_lookup() function can return a valid (error-free) route entry whose rt6i_idev field is NULL — a state that arises when an external nexthop device's MTU is lowered below IPV6_MIN_MTU, which tears down the device's inet6_dev structure, while fib6_ifdown() leaves associated routes referencing nexthop objects intact in the FIB. An unprivileged user with access to a private user and network namespace can use rtnetlink to construct this state, then send an IPv6 packet that triggers an rpfilter lookup, causing a kernel panic via a general protection fault. The fix rejects routes lacking an inet6_dev immediately after lookup, before any rt6i_idev dereferences occur (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a kernel panic and system crash, causing a complete loss of availability for the affected host. The impact is limited to Denial of Service — there is no confidentiality or integrity impact, as the vulnerability does not enable code execution or data exfiltration. The attack is constrained to the local system, but any unprivileged user with access to user namespaces can trigger it, making it a meaningful threat in multi-tenant or container environments where user namespaces are enabled (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of publication (Github Advisory). The EPSS score is approximately 0.164% (0.00164), indicating a low near-term exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only low privileges (access to user namespaces) and no user interaction, but is limited to local attack vectors.

1. Gain local access: Obtain an unprivileged user account on a Linux system with user namespace support enabled (the default on most modern distributions).
2. Create isolated namespaces: Use unshare(1) or equivalent syscalls to create a private user namespace and network namespace, granting effective control over network configuration within the namespace.
3. Configure a nexthop route with external device: Using rtnetlink (e.g., via ip commands or raw netlink sockets), set up an IPv6 route that uses an external nexthop object referencing a network device.
4. Tear down inet6_dev: Lower the MTU of the nexthop device below IPV6_MIN_MTU (1280 bytes) using rtnetlink. This causes the kernel to destroy the device's inet6_dev structure while leaving the FIB route entry intact with a NULL rt6i_idev.
5. Trigger rpfilter lookup: Send an IPv6 packet (e.g., via AF_PACKET socket using sendto) that causes the netfilter ip6t_rpfilter match to perform a reverse-path lookup, hitting the route with the NULL rt6i_idev and triggering a kernel panic (Github Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing Oops: general protection fault or KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] with RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) in the call trace.
• Logs: Kernel panic messages: Kernel panic - not syncing: Fatal exception in interrupt following the above trace.
• Process/Behavior: Unexpected system reboots or crashes on systems with IPv6 rpfilter netfilter rules active.
• Network: Unusual AF_PACKET socket activity (packet_sendmsg) from unprivileged processes combined with rtnetlink MTU modification events visible in audit logs or network namespace activity logs.

Update the Linux kernel to a fixed stable version: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9, or 7.3-rc5 and later. Patches are available via the upstream kernel stable tree at git.kernel.org. As a workaround where patching is not immediately possible, restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 (on supported distributions) or user.max_user_namespaces=0 via sysctl, which prevents unprivileged users from constructing the required namespace state. Red Hat has tracked this issue in Bugzilla and distributions should be monitored for vendor-specific kernel updates (Github Advisory, Red Hat Bugzilla, Microsoft).

The vulnerability was mentioned in coverage of Microsoft's October 2026 Patch Tuesday, which addressed a record number of flaws (BleepingComputer). No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard vulnerability database aggregation.