In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a…
High CVSS 7.5
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL. Reproduced b…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c
- https://git.kernel.org/stable/c/e7123e10c86eb88eaa90537dd1f232706de2d308
- https://git.kernel.org/stable/c/eab3a917cdcb182542a3aac6a0d2d30659ca9821
- https://git.kernel.org/stable/c/f826df95332c07380206dbd54178b6eefb311aba
Timeline
- nvd_ingest NVD