The Linux kernel vulnerability CVE-2026-89561 involves a NULL pointer dereference in the ipv6_rpl_srh_rcv() function. This function dereferences idev obtained from __in6_dev_get() without verifying if idev is NULL. When the network device's MTU falls below IPV6_MIN_MTU, the ip6_ptr pointer can be cleared, causing idev to be NULL. A packet passing initial checks can then cause a NULL dereference in ipv6_rpl_srh_rcv(), leading to a kernel crash detected by KASAN. The issue is reproducible by flooding the interface with ping6 traffic while rapidly changing the MTU. The fix moves the NULL check to ipv6_rthdr_rcv(), which calls ipv6_rpl_srh_rcv() and ipv6_srh_rcv(), passing idev as an argument only if it is valid, thus preventing the NULL dereference and safely dropping packets when IPv6 is disabled on the device.

This vulnerability can cause a kernel crash (NULL pointer dereference) on affected Linux systems when processing IPv6 packets under specific network conditions involving MTU changes and traffic flooding. This results in a denial of service condition. There is no indication of code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by adding a NULL check for idev in the ipv6_rthdr_rcv() function before calling ipv6_rpl_srh_rcv() or ipv6_srh_rcv(). Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the input data; users should consult the Linux kernel vendor advisory or distribution security updates for the specific fixed versions.