CVE-2021-47572 is a vulnerability in the Linux kernel related to the handling of IPv6 nexthop objects when IPv6 support is not enabled (i.e., when the kernel is compiled without CONFIG_IPV6). Specifically, the vulnerability arises from a null pointer dereference in the function nh_create_ipv6(). This occurs because the error handling path incorrectly calls ipv6_stub->fib6_nh_release, which is not properly initialized when IPv6 is disabled, leading to a kernel NULL pointer dereference and consequent kernel crash (panic). The root cause is that the dummy stub for fib6_nh_release should not be called if fib6_nh_init returns an error, but the code erroneously calls fib6_nh_release in the error path. This bug has existed since the introduction of IPv6 nexthop gateway support in the Linux kernel. The vulnerability can be triggered when an attempt is made to add an IPv6 nexthop while IPv6 is disabled, causing a denial of service (DoS) due to kernel panic. The provided kernel oops trace confirms the NULL pointer dereference and the crash occurring in the kernel networking code path related to routing netlink messages. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The issue is resolved by modifying the error path in nh_create_ipv6() to avoid calling the uninitialized fib6_nh_release stub and instead return an appropriate error code directly.

The primary impact of CVE-2021-47572 is a denial of service condition caused by a kernel panic triggered when IPv6 nexthop configuration is attempted on a Linux system with IPv6 disabled. For European organizations, this vulnerability could disrupt critical network infrastructure components running Linux kernels affected by this bug, especially network routers, firewalls, or servers handling routing configurations. Systems that process netlink messages for routing updates are at risk of crashing, potentially causing service outages. Although exploitation requires sending crafted netlink messages to the kernel, this can be done locally or potentially remotely if an attacker has access to a privileged network interface or can induce the vulnerable code path. The vulnerability does not appear to allow privilege escalation or code execution but can cause system instability and downtime. Organizations relying on Linux-based network appliances or servers in Europe could face operational disruptions, impacting availability of network services. Given the widespread use of Linux in European data centers, telecom infrastructure, and enterprise environments, the risk of service interruption is significant if unpatched systems are targeted.

To mitigate CVE-2021-47572, European organizations should: 1) Apply the official Linux kernel patches that fix the error path in nh_create_ipv6(), ensuring that the fib6_nh_release stub is not called when IPv6 is disabled. 2) Upgrade to a Linux kernel version that includes the fix or backport the patch if using long-term support kernels. 3) Audit network configurations to avoid attempts to add IPv6 nexthops on systems where IPv6 is disabled. 4) Restrict access to netlink sockets and routing configuration interfaces to trusted administrators only, minimizing the risk of malicious or accidental triggering of the vulnerability. 5) Monitor kernel logs and system stability for signs of crashes related to routing updates. 6) Implement network segmentation and access controls to limit exposure of vulnerable systems to untrusted users or networks. 7) For critical infrastructure, consider deploying kernel hardening features and runtime protections that can mitigate the impact of kernel null pointer dereferences. These measures go beyond generic advice by focusing on configuration hygiene, access control, and patch management specific to this vulnerability.