CVE-2026-53214: Linux Kernel IPv6 Null Pointer Dereference in cleanup_prefix_route()

Technical summary

CVE-2026-53214 is a null pointer dereference (CWE-476) in the Linux kernel's net/ipv6/addrconf.c module, specifically in the cleanup_prefix_route() function. The function calls addrconf_get_prefix_route() which can return the fib6_null_entry sentinel entry—an internal placeholder that has a NULL fib6_table pointer. The vulnerable code path attempts to access and modify this null pointer without validation, leading to a general protection fault. The crash occurs when setting the route's expiration time on this sentinel entry. The vulnerability is triggered through IPv6 address deletion operations, typically via netlink socket calls (inet6_rtm_deladdr). Other callers of addrconf_get_prefix_route() either request routes with flags not present on the sentinel or have separate protections against this condition.

Business impact

This vulnerability enables local denial-of-service attacks against Linux systems, potentially affecting service availability on multi-tenant environments, containers, or systems where unprivileged users can manage network interfaces. Affected systems experience kernel crashes that disrupt network services and require manual intervention to restore. Organizations relying on IPv6 infrastructure for critical services may face unplanned downtime. The impact is limited to local attackers with the ability to invoke IPv6 address configuration changes, reducing the blast radius compared to remote exploits.

Affected systems

The Linux kernel is affected. The vulnerability impacts systems across multiple architectures and distributions that include vulnerable kernel versions. While the specific vulnerable kernel versions are not detailed in the source data, any Linux distribution shipping an affected kernel would be impacted. Organizations should verify their kernel version against vendor advisories from their Linux distribution maintainer.

Exploitability

Exploitation requires local access and sufficient privileges to invoke IPv6 address deletion operations, typically through netlink socket calls. The vulnerability is not remotely exploitable. The CVSS vector (AV:L/AC:L/PR:L) reflects that exploitation is straightforward once local access and appropriate privileges are obtained—there are no complex attack conditions or user interactions required. An attacker with local user-level capabilities can reliably trigger the crash through standard network configuration interfaces.

Remediation

Apply a kernel update containing the patch that adds null pointer validation in cleanup_prefix_route() before attempting to access the fib6_table pointer. Organizations should verify the specific patched kernel versions from their Linux distribution maintainer. Interim workarounds may include restricting user-level access to IPv6 address configuration commands through privilege escalation controls or network namespace isolation in multi-tenant environments.

Patch guidance

Obtain and deploy the patched Linux kernel version from your distribution maintainer. The patch adds a validation check to ensure cleanup_prefix_route() does not attempt to modify the fib6_null_entry sentinel. Verify the patch against your vendor's official security advisory to confirm the correct kernel version. Following patching, a system reboot is required to load the fixed kernel. Test the patch in a non-production environment first, particularly in containerized or virtualized deployments where IPv6 is actively configured.

Detection guidance

Monitor kernel logs and system messages for 'general protection fault' errors, particularly those referencing net/ipv6/addrconf.c or the cleanup_prefix_route function. Audit netlink traffic for IPv6 address deletion requests (inet6_rtm_deladdr operations) from unexpected or untrusted user accounts. In containerized environments, monitor for unexpected kernel panic events correlated with IPv6 network reconfigurations. Intrusion detection systems should flag repeated kernel crashes originating from IPv6 address management calls, as this may indicate exploitation attempts.

Why prioritize this

While the CVSS score of 5.5 (Medium) reflects the local-only attack vector, organizations with IPv6 deployments should prioritize patching based on their risk tolerance for service disruption. The vulnerability is trivial to exploit locally and affects system stability directly. Multi-tenant environments, container platforms, and systems where unprivileged users manage IPv6 addresses should treat this as higher priority. Single-user or tightly controlled systems may defer patching to routine maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: local attack vector (no remote exploitation), low attack complexity (straightforward trigger), requirement for low privileges (user-level access to network configuration), no confidentiality or integrity impact, but high availability impact due to kernel crash. The score appropriately captures that this is a local denial-of-service vector without data breach potential. Organizational risk should factor in the prevalence of IPv6 in infrastructure and the tolerance for unplanned kernel crashes.

Frequently asked questions