CVE-2026-97601: Linux kernel · ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in bf79662bc85e820ac3b846e2f347da29fbf6ac95 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in bf79662bc85e820ac3b846e2f347da29fbf6ac95, a1760f21c32adce41af5ed5687200865d8feaaeb, 543994fa03c36a91d967a12c5c99cae74899504c +5
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
This vulnerability has been fixed in the Linux kernel versions identified by the provided commit hashes. Users should update their Linux kernel to a fixed version containing these commits to remediate the issue. No additional mitigation is indicated.
Description
A NULL pointer dereference vulnerability in the Linux kernel's ieee802154 6lowpan subsystem was fixed. The issue occurs when a TUN device changes its link-layer type to ARPHRD_IEEE802154 without initializing the ieee802154_ptr pointer. The lowpan_newlink() function only checks the device type before dereferencing this pointer, which can lead to a NULL pointer dereference triggered by an RTM_NEWLINK request. The fix rejects devices lacking ieee802154_ptr as well as devices of the wrong type.
References
- git.kernel.org/stable/c/a1760f21c32adce41af5ed5687200865d8feaaeb (opens in a new tab)
- git.kernel.org/stable/c/5063b9354e6e285dae61e530b30458498444a914 (opens in a new tab)
- git.kernel.org/stable/c/16d8e0b560d50cd1a9e6d77a9a154a94c4d6021e (opens in a new tab)
- git.kernel.org/stable/c/543994fa03c36a91d967a12c5c99cae74899504c (opens in a new tab)
- git.kernel.org/stable/c/1c7710af7ad9532b534f1c134c11b04dbe4e0e0f (opens in a new tab)
- git.kernel.org/stable/c/98ce5a42cde780ee0e40378607d4428c8fc12ec1 (opens in a new tab)
- git.kernel.org/stable/c/8528da2333ce05cf627f93425f9d05efb08b3146 (opens in a new tab)
- git.kernel.org/stable/c/bf79662bc85e820ac3b846e2f347da29fbf6ac95 (opens in a new tab)