CVE-2026-53012: Linux Kernel NULL Pointer Dereference in IPv6 Nexthop Routing

Technical summary

The vulnerability exists in the Linux kernel's nexthop subsystem. The has_v4 flag in nexthop groups is meant to track whether the group contains any IPv4 members. The kernel only updates this flag when replacing an AF_INET nexthop with AF_INET6, but fails to update it in the reverse direction—when replacing AF_INET6 with AF_INET. This leaves a stale has_v4=false value that bypasses the fib6_check_nexthop validation, allowing IPv6 routes to be attached to groups containing only IPv4 nexthops. When route lookup later calls nexthop_fib6_nh() on an AF_INET member, it returns NULL, triggering a NULL pointer dereference and kernel panic. The fix requires calling nh_group_v4_update for all address family changes, not just the AF_INET→AF_INET6 direction.

Business impact

This vulnerability enables a denial-of-service attack against systems running affected Linux kernels. A local attacker with namespace or networking privileges can crash the kernel by manipulating nexthop routing configuration, disrupting network connectivity for all services on the system. The impact is limited to local attack surface and does not expose data or enable privilege escalation, but the availability impact is severe—any affected system can be reliably taken offline.

Affected systems

Affected are Linux kernel versions with the nexthop subsystem that do not include the fix. The exact affected range is not specified in vendor advisories and should be verified against official Linux kernel release notes and security advisories. Systems using advanced routing features (nexthop groups, route replacement operations) are more likely to be impacted. This includes modern network appliances, cloud infrastructure nodes, and container hosts that rely on kernel-level routing management.

Exploitability

Exploitability is moderate. The attack requires local access and the ability to execute routing configuration commands (typically requiring CAP_NET_ADMIN or equivalent network namespace privileges). It is not remotely exploitable. The reproducer provided demonstrates the vulnerability is straightforward to trigger for an attacker with the necessary permissions—a simple sequence of nexthop replacement and IPv6 route addition commands followed by ping traffic. No special kernel hardening bypass is needed. This makes it a practical denial-of-service vector in multi-tenant environments or systems where users have network configuration privileges.

Remediation

The primary remediation is to apply a Linux kernel update that includes the fix to nh_group_v4_update. The fix ensures that the has_v4 flag is recalculated whenever a nexthop's address family changes, in both directions (AF_INET to AF_INET6 and vice versa). Verify the specific kernel version containing this fix against your Linux distribution's advisory. As an interim mitigation, restrict CAP_NET_ADMIN and network namespace creation to trusted users only, and monitor for unusual nexthop configuration changes.

Patch guidance

Patch releases containing this fix should be available from your Linux distribution's security update channels. Check your vendor's security advisory for the specific kernel version addressing CVE-2026-53012. Red Hat, Ubuntu, Debian, and other major distributions will release kernel updates separately; do not rely on upstream kernel.org versions alone. Apply the patch during a planned maintenance window that allows for kernel reboot. Test the patched kernel in a staging environment if possible, particularly if your infrastructure relies heavily on nexthop-based routing or network namespaces.

Detection guidance

Monitor system logs and kernel logs for NULL pointer dereference panics (oops messages) occurring during IPv6 route lookups or nexthop operations. Check for Ctrl-Alt-SysRq or kdump crash logs that reference nexthop_fib6_nh() or fib6_check_nexthop(). On systems supporting kernel tracing, enable tracepoints on nexthop replace and route add operations to correlate address family changes with crashes. Audit routing configuration changes using ip nexthop and ip route commands for suspicious replacement patterns (e.g., AF_INET6 replaced with AF_INET in a single operation).

Why prioritize this

Despite the medium CVSS score, this should be prioritized for patching on any system where local users or tenants have network configuration capabilities. The simplicity of exploitation, reliability of the crash, and severity of the resulting denial of service outweigh the CVSS rating. Multi-tenant cloud infrastructure, Kubernetes nodes, and network appliances should be patched urgently. Standalone servers with restricted network administrative access may be deprioritized if local attack surface is already constrained.

Risk score, explained

CVSS 5.5 (Medium) reflects a local-only attack vector, low privileges required, and no impact to confidentiality or integrity. However, the attack guarantees availability impact (kernel crash), requires no user interaction, and is trivial to exploit for an attacker with the necessary local access. The score does not weight the operational severity of kernel panics in production environments; security teams should factor in their reliance on affected systems' uptime and the number of untrusted local users or tenants.

Frequently asked questions