CVE-2026-80646 (GCVE-0-2026-80646)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < a23f2c68c6635e41404f189f8f7ae910738cebdb (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < e14db43677946bf2095febd294bb3c13ab375ab7 (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < 1a4adfbeb47a212a64539137411f1ca168474d33 (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < 1e3db30a88815bae6e9d5db6f64ac735e615a07e (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < 952426a83ca75cea25c09d58944abafaa3ebd242 (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < 0db1949084e85a72d174a7dea3259b94fe5a9305 (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < fc920c0659cdea5afd8721c1155a51564859e075 (git)
Affected: e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f , < 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc (git)
Affected: a24963500a4ec921ce9c2597e0a584e44513afae (git)
Affected: 4.19.291 , < 4.20 (semver)
Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/addrconf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a23f2c68c6635e41404f189f8f7ae910738cebdb",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "e14db43677946bf2095febd294bb3c13ab375ab7",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "1a4adfbeb47a212a64539137411f1ca168474d33",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "1e3db30a88815bae6e9d5db6f64ac735e615a07e",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "952426a83ca75cea25c09d58944abafaa3ebd242",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "0db1949084e85a72d174a7dea3259b94fe5a9305",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "fc920c0659cdea5afd8721c1155a51564859e075",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "lessThan": "507541c2a8eeb76c02bd2511958f73a8cfa3e1bc",
              "status": "affected",
              "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a24963500a4ec921ce9c2597e0a584e44513afae",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.291",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/addrconf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.291",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: guard against possible NULL deref in __in6_dev_stats_get()\n\ndev_get_by_index_rcu() could return NULL if the original physical\ndevice is unregistered.\n\nFound by Sashiko."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote attackers reach ipv6_frag_rcv() through the standard IPv6 receive and local-delivery path (ipv6_rcv to ip6_protocol_deliver_rcu) by sending fragmented IPv6 packets to an Internet-facing host running IPv6 reassembly on a VRF/L3-master ingress path.\nAC:L - An attacker can repeatedly deliver IPv6 fragments and time them against concurrent netdev unregister (link teardown, container veth removal, or ip link del with CAP_NET_ADMIN in a user namespace), controlling both sides of the race rather than depending on uncontrollable layout.\nPR:N - Sending unauthenticated IPv6 fragments requires no kernel credentials; VRF/L3-master configuration is a deployment condition on routers and cloud hosts, not a privilege the attacker must hold to deliver the triggering traffic.\nUI:N - Exploitation needs only network delivery of fragmented IPv6 packets during interface teardown; no victim action such as opening files, clicking links, or mounting filesystems is required.\nS:U - The NULL dereference crashes the kernel on the receiving host but does not cross a VM, container, or IOMMU security boundary; impact stays within the same kernel security authority.\nC:N - The failure is a NULL pointer read in __in6_dev_get(NULL) after dev_get_by_index_rcu() returns NULL; there is no use-after-free, out-of-bounds read, or other information-disclosure primitive.\nI:N - The bug dereferences a NULL net_device pointer for statistics lookup only; it provides no memory write, corruption, or control-flow hijack primitive beyond crashing the kernel.\nA:H - The NULL dereference during IPv6 fragment receive/reassembly processing in softirq context causes a kernel OOPS or panic, fully denying availability on the affected system until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:41.550Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a23f2c68c6635e41404f189f8f7ae910738cebdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e14db43677946bf2095febd294bb3c13ab375ab7"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a4adfbeb47a212a64539137411f1ca168474d33"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e3db30a88815bae6e9d5db6f64ac735e615a07e"
        },
        {
          "url": "https://git.kernel.org/stable/c/952426a83ca75cea25c09d58944abafaa3ebd242"
        },
        {
          "url": "https://git.kernel.org/stable/c/0db1949084e85a72d174a7dea3259b94fe5a9305"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc920c0659cdea5afd8721c1155a51564859e075"
        },
        {
          "url": "https://git.kernel.org/stable/c/507541c2a8eeb76c02bd2511958f73a8cfa3e1bc"
        }
      ],
      "title": "ipv6: guard against possible NULL deref in __in6_dev_stats_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80646",
    "datePublished": "2026-08-28T06:48:56.277Z",
    "dateReserved": "2026-08-26T14:34:25.779Z",
    "dateUpdated": "2026-08-29T06:21:41.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80646",
      "date": "2026-10-05",
      "epss": "0.00716",
      "percentile": "0.52166"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/addrconf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a23f2c68c6635e41404f189f8f7ae910738cebdb",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e14db43677946bf2095febd294bb3c13ab375ab7",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a4adfbeb47a212a64539137411f1ca168474d33",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1e3db30a88815bae6e9d5db6f64ac735e615a07e",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "952426a83ca75cea25c09d58944abafaa3ebd242",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0db1949084e85a72d174a7dea3259b94fe5a9305",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc920c0659cdea5afd8721c1155a51564859e075",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "507541c2a8eeb76c02bd2511958f73a8cfa3e1bc",
                    "status": "affected",
                    "version": "e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a24963500a4ec921ce9c2597e0a584e44513afae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.291",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/addrconf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: guard against possible NULL deref in __in6_dev_stats_get()\n\ndev_get_by_index_rcu() could return NULL if the original physical\ndevice is unregistered.\n\nFound by Sashiko."
          }
        ],
        "id": "CVE-2026-80646",
        "lastModified": "2026-08-29T07:16:48.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:49.550",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0db1949084e85a72d174a7dea3259b94fe5a9305"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1a4adfbeb47a212a64539137411f1ca168474d33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1e3db30a88815bae6e9d5db6f64ac735e615a07e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/507541c2a8eeb76c02bd2511958f73a8cfa3e1bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/952426a83ca75cea25c09d58944abafaa3ebd242"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a23f2c68c6635e41404f189f8f7ae910738cebdb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e14db43677946bf2095febd294bb3c13ab375ab7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fc920c0659cdea5afd8721c1155a51564859e075"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T12:37:00+00:00",
      "cve": "CVE-2026-80646",
      "id": "CVE-2026-80646",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: guard against possible NULL deref in __in6_dev_stats_get()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80646.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-03T00:20:57Z",
      "cve": "CVE-2026-80646",
      "id": "CVE-2026-80646",
      "initial_release_date": "2026-08-28T16:35:18Z",
      "product_status:known_affected": "262",
      "product_status:known_not_affected": "93",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80646",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80646.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.