Bug 2502617 (CVE-2026-64116) - CVE-2026-64116 kernel: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Summary: CVE-2026-64116 kernel: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Keywords:
Status: NEW
Alias: CVE-2026-64116
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-19 17:09 UTC by OSIDB Bzimport
Modified: 2026-07-20 06:43 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-19 17:09:08 UTC
In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Reported by Sashiko:

The function ipv6_hop_ioam() accesses
__in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned
idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr
via RCU, __in6_dev_get() can return NULL during interface teardown, which
could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop
option.

Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.


Note You need to log in before you can comment on or make changes to this bug.