CVE-2026-23442

In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)

CWE

CWE-476

Published

2026-04-03

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• linux:linux_kernel

References

• https://git.kernel.org/stable/c/0348fa0ada37cef7c6b5ab2a428bb2c6aee784e4
• https://git.kernel.org/stable/c/06413793526251870e20402c39930804f14d59c0
• https://git.kernel.org/stable/c/50352fc103928e10e8729abc79a0d05abef26c4d
• https://git.kernel.org/stable/c/83d705d35e583cb1b1eacf196dfe7b77d442018e
• https://git.kernel.org/stable/c/a25853c9feea7bbf31d157ff6e004d2d3b4f7f13

Check your stackJSON