In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The… (CVE-2026-64116)
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.
AI Analysis
Technical Summary
The Linux kernel's ipv6_hop_ioam() function accessed __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Since addrconf_ifdown() can clear dev->ip6_ptr concurrently via RCU, __in6_dev_get() may return NULL during interface teardown. This race condition could lead to a NULL pointer dereference when processing an IOAM Hop-by-Hop option. The fix adds a NULL check for idev and uses SKB_DROP_REASON_IPV6DISABLED to handle this case safely.
Potential Impact
A NULL pointer dereference vulnerability could cause a kernel crash or denial of service when processing specific IPv6 IOAM packets during interface teardown. There is no indication of code execution or privilege escalation from this vulnerability.
Mitigation Recommendations
A fix has been implemented that adds a NULL check for the idev pointer in ipv6_hop_ioam(). Users should apply the official Linux kernel update that includes this patch to remediate the issue. No other mitigation steps are indicated.
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The… (CVE-2026-64116)
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ipv6_hop_ioam() function accessed __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Since addrconf_ifdown() can clear dev->ip6_ptr concurrently via RCU, __in6_dev_get() may return NULL during interface teardown. This race condition could lead to a NULL pointer dereference when processing an IOAM Hop-by-Hop option. The fix adds a NULL check for idev and uses SKB_DROP_REASON_IPV6DISABLED to handle this case safely.
Potential Impact
A NULL pointer dereference vulnerability could cause a kernel crash or denial of service when processing specific IPv6 IOAM packets during interface teardown. There is no indication of code execution or privilege escalation from this vulnerability.
Mitigation Recommendations
A fix has been implemented that adds a NULL check for the idev pointer in ipv6_hop_ioam(). Users should apply the official Linux kernel update that includes this patch to remediate the issue. No other mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6p6q-g32r-gx25
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64116"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912bbb8
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:49:40 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.