CVE-2026-64116 — ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Reported by Sashiko:

The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option.

Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly.

Most recent entries from all

CVE-2026-64116 — ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()