AZL-80702
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-80702.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-80702
- Upstream
- Published
- 2026-03-25T11:16:38Z
- Modified
- 2026-08-28T17:46:33.070447593Z
- Summary
- CVE-2026-23381 affecting package kernel for versions less than 6.6.130.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the ndtbl is never initialized because inet6init() exits before ndiscinit() is called which initializes it. Then, if neighsuppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, brdosuppressnd() will dereference ipv6stub->ndtbl which is NULL, passing it to neighlookup(). This causes a kernel NULL pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000268 Oops: 0000 [#1] PREEMPT SMP NOPTI [...] RIP: 0010:neighlookup+0x16/0xe0 [...] Call Trace: <IRQ> ? neighlookup+0x16/0xe0 brdosuppressnd+0x160/0x290 [bridge] brhandleframefinish+0x500/0x620 [bridge] brhandleframe+0x353/0x440 [bridge] __netifreceiveskb_core.constprop.0+0x298/0x1110 __netifreceiveskb_onecore+0x3d/0xa0 processbacklog+0xa0/0x140 _napipoll+0x2c/0x170 netrxaction+0x2c4/0x3a0 handlesoftirqs+0xd0/0x270 dosoftirq+0x3f/0x60
Fix this by replacing ISENABLED(IPV6) call with ipv6mod_enabled() in the callers. This is in essence disabling NS/NA suppression when IPv6 is disabled.
- References