Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies it as a reject route. This is because nexthop objects have no destination prefix (fc_dst=::), causing fib6_is_reject() to match any loopback nexthop. The reject path skips fib_nh_common_init(), leaving nhc_pcpu_rth_output unallocated. If an IPv4 route later references this nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and panics. Simplify the check in fib6_nh_init() to only match explicit reject routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback promotion heuristic in fib6_is_reject() is handled separately by ip6_route_info_create_nh(). After this change, the three cases behave as follows: 1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"): RTF_REJECT is set, enters reject path, skips fib_nh_common_init(). No behavior change. 2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. ip6_route_info_create_nh() still promotes it to reject afterward. nhc_pcpu_rth_output is allocated but unused, which is harmless. 3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. nhc_pcpu_rth_output is properly allocated, fixing the crash when IPv4 routes reference this nexthop.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < 607e68c1b7c5a30c795571be1906d716e989a644affected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < c11d7c56c2076ee9cd72004f1976fe0734df2ae9affected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < b5062fc2150614c9ea8a611c2e0cb6e047ebfa3aaffected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < b299121e7453d23faddf464087dff513a495b4fcaffected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < f7c9f8e3607440fe39300efbaf46cf7b5eecb23faffected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < b3b5a037d520afe3d5276e653bc0ff516bbda34caffected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < 8650db85b4259d2885d2a80fbc2317ce24194133affected493ced1ac47c48bb86d9d4e8e87df8592be85a0e to < 21ec92774d1536f71bdc90b0e3d052eff99cf093affected
Linux Linux
Default version status: affected
5.3affected0 to < 5.3unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.18.17 to ≤ 6.18.*unaffected6.19.7 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/607e68c1b7c5a30c795571be1906d716e989a644 ↗
- https://git.kernel.org/stable/c/c11d7c56c2076ee9cd72004f1976fe0734df2ae9 ↗
- https://git.kernel.org/stable/c/b5062fc2150614c9ea8a611c2e0cb6e047ebfa3a ↗
- https://git.kernel.org/stable/c/b299121e7453d23faddf464087dff513a495b4fc ↗
- https://git.kernel.org/stable/c/f7c9f8e3607440fe39300efbaf46cf7b5eecb23f ↗
- https://git.kernel.org/stable/c/b3b5a037d520afe3d5276e653bc0ff516bbda34c ↗
- https://git.kernel.org/stable/c/8650db85b4259d2885d2a80fbc2317ce24194133 ↗
- https://git.kernel.org/stable/c/21ec92774d1536f71bdc90b0e3d052eff99cf093 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗