CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved:

mpls: fix NULL deref in mplsvalidfibdumpreq() on CONFIG_INET=n

On CONFIGINET=n builds, mplsvalidfibdumpreq() walks the parsed attribute table itself instead of calling ipvalidfibdumpreq(). The RTAOIF arm passes tb[RTAOIF] to nlagetu32() without checking it is present, so an RTMGETROUTE dump for AFMPLS with strict checking and no RTAOIF hits a NULL dereference.

RTMGETROUTE is RTNLKINDGET, which rtnetlinkrcvmsg() permits without CAPNET_ADMIN, so an unprivileged user can trigger it.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mplsvalidfibdumpreq (net/mpls/afmpls.c:2189) Call Trace: mplsdumproutes (net/mpls/afmpls.c:2236) netlinkdump (net/netlink/afnetlink.c:2331) __netlinkdumpstart (net/netlink/afnetlink.c:2446) rtnetlinkrcvmsg (net/core/rtnetlink.c:7033) netlinkrcvskb (net/netlink/afnetlink.c:2556) netlinkunicast (net/netlink/afnetlink.c:1345) netlinksendmsg (net/netlink/afnetlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) _syssendmsg (net/socket.c:2770) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121)

Skip unset attributes, as ipvalidfibdumpreq() does.