AZL-96446
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96446.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-96446
- Upstream
- Published
- 2026-08-15T06:22:12Z
- Modified
- 2026-08-29T05:27:27Z
- Summary
- CVE-2026-72392 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fib6: fix NULL deref in fib6walkcontinue() on multi-batch dump
inet6dumpfib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6newtable() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6dumptable() to set w->root to the wrong table while w->node still points into the previous one. fib6walkcontinue() dereferences w->node->parent (NULL) and panics:
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6walkcontinue+0x6e/0x170 Call Trace: <TASK> fib6dumptable.isra.0+0xc5/0x240 inet6dumpfib+0xf6/0x420 rtnldumpit+0x30/0xa0 netlinkdump+0x15b/0x460 netlink_recvmsg+0x1d6/0x2a0 ___sysrecvmsg+0x17a/0x190
Fix by storing tb->tb6_id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.
- References