{"id":"CVE-2026-64116","state":"PUBLISHED","title":"ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: add NULL check for idev in ipv6_hop_ioam()\n\nReported by Sashiko:\n\nThe function ipv6_hop_ioam() accesses\n__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned\nidev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr\nvia RCU, __in6_dev_get() can return NULL during interface teardown, which\ncould cause a NULL pointer dereference when processing an IOAM Hop-by-Hop\noption.\n\nLet's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.","publishedAt":"2026-07-19T15:40:16.240Z","updatedAt":"2026-08-05T12:39:25.437Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"c7e8971abd70e9d022f1c251ba2508f8dc7f2db8","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"09cbfd4b81ae90963dadb1de99b63b702e73290a","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"1dca7e491f070ac49b3d934f16ee953a53b37f38","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"902daac307eb7e1955ce05b071950f3cba88c963","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"abdd03229414b5a52943b65a60f34b84cea5ac59","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"cf75eb6617042c8cff6112daeed7791809fc9dd2","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/exthdrs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.92","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/exthdrs.c"]}],"references":["https://git.kernel.org/stable/c/c7e8971abd70e9d022f1c251ba2508f8dc7f2db8","https://git.kernel.org/stable/c/09cbfd4b81ae90963dadb1de99b63b702e73290a","https://git.kernel.org/stable/c/1dca7e491f070ac49b3d934f16ee953a53b37f38","https://git.kernel.org/stable/c/902daac307eb7e1955ce05b071950f3cba88c963","https://git.kernel.org/stable/c/abdd03229414b5a52943b65a60f34b84cea5ac59","https://git.kernel.org/stable/c/cf75eb6617042c8cff6112daeed7791809fc9dd2","https://git.kernel.org/stable/c/d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64116.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64116","state":"PUBLISHED","datePublished":"2026-07-19T15:40:16.240Z","dateUpdated":"2026-08-05T12:39:25.437Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.035Z"},"containers":{"cna":{"title":"ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: add NULL check for idev in ipv6_hop_ioam()\n\nReported by Sashiko:\n\nThe function ipv6_hop_ioam() accesses\n__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned\nidev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr\nvia RCU, __in6_dev_get() can return NULL during interface teardown, which\ncould cause a NULL pointer dereference when processing an IOAM Hop-by-Hop\noption.\n\nLet's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"c7e8971abd70e9d022f1c251ba2508f8dc7f2db8","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"09cbfd4b81ae90963dadb1de99b63b702e73290a","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"1dca7e491f070ac49b3d934f16ee953a53b37f38","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"902daac307eb7e1955ce05b071950f3cba88c963","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"abdd03229414b5a52943b65a60f34b84cea5ac59","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"cf75eb6617042c8cff6112daeed7791809fc9dd2","versionType":"git"},{"version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","status":"affected","lessThan":"d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/exthdrs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.92","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/exthdrs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c7e8971abd70e9d022f1c251ba2508f8dc7f2db8"},{"url":"https://git.kernel.org/stable/c/09cbfd4b81ae90963dadb1de99b63b702e73290a"},{"url":"https://git.kernel.org/stable/c/1dca7e491f070ac49b3d934f16ee953a53b37f38"},{"url":"https://git.kernel.org/stable/c/902daac307eb7e1955ce05b071950f3cba88c963"},{"url":"https://git.kernel.org/stable/c/abdd03229414b5a52943b65a60f34b84cea5ac59"},{"url":"https://git.kernel.org/stable/c/cf75eb6617042c8cff6112daeed7791809fc9dd2"},{"url":"https://git.kernel.org/stable/c/d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 receive path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts → ipv6_hop_ioam), triggered by a remotely deliverable IPv6 packet with a Hop-by-Hop IOAM option.\nAC:L - An attacker can reliably win the TOCTOU race by flooding IOAM Hop-by-Hop packets while concurrently unregistering the netdev (e.g., via user namespace with CAP_NET_ADMIN and `ip link del`), controlling both sides of the race.\nPR:N - No kernel privileges are required to send crafted IPv6 packets; interface unregister also occurs during normal container/pod lifecycle on shared cloud hosts without attacker admin action.\nUI:N - Exploitation requires only sending network packets during interface teardown and does not depend on any victim user action.\nS:U - Impact is a kernel NULL dereference and crash on the receiving host; it does not cross a VM, container, or IOMMU security boundary.\nC:N - The fault is a NULL pointer read at a fixed offset (idev->cnf.ioam6_enabled), causing an immediate page fault with no controlled or bounded information disclosure.\nI:N - This is a read-side NULL dereference only; there is no memory corruption, arbitrary write, or code execution primitive.\nA:H - A successful trigger causes a kernel NULL pointer dereference, producing an oops or panic and denying service on the affected system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:39:25.437Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}