Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown() clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(), but this re-fetch is unguar
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:766d0ef761e3653a8adb98fb7abdaaa98fd42c86dbf1bed3fc5a1709e27f878f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d08d019f2f43a6f9a71e81868bbc326b3afaf37b","status":"affected","version":"c0b220cf7d80eb8a36ae9f12cae6df4577a6814e","versionType":"git"},{"lessThan":"1451deca9896957159f0666520a792c1b861af4f","status":"affected","version":"c0b220cf7d80eb8a36ae9f12cae6df4577a6814e","versionType":"git"},{"lessThan":"b2c70dd3326809429b709a9c7e9220d29923051a","status":"affected","version":"c0b220cf7d80eb8a36ae9f12cae6d…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqua…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d08d019f2f43a6f9a71e81868bbc326b3afaf37b","status":"affected","version":"c0b220cf7d80eb8a36ae9f12cae6df4577a6814e","versionType":"git"},{"lessThan":"1451deca9896957159f0666520a792c1b861af4f","status":"affected","version":"c0b220cf7d80eb8a36ae9f12cae6df4577a6814e","versionType":"git"},{"lessThan":"b2c70dd3326809429b709a9c7e9220d29923051a","status":"affected","version":"c0b220cf7d80eb8a36ae9f12cae6d…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqua…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/affected/1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/1451deca9896957159f0666520a792c1b861af4f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/302d57ed7872838b40e56a868fb4c7da7da606e9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/46c3b8191aad3d032776bf3bebf03efdf5f4b905"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/6428634f7a0b7878144b4925c37856bef3224967"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/80600b5d0f3ecb9324120dc95b5e915130f516c5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/b0d0eb13a0441a8ebf4f227843deaf494f1e2c33"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/b2c70dd3326809429b709a9c7e9220d29923051a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/d08d019f2f43a6f9a71e81868bbc326b3afaf37b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5c5c162bd06311b5d2bd2e4a5825b909aa9cf990a1410465a9f2450621fa033 · sha256:fdf2b1ba30798e58… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer