« Volver al listado

CVE-2026-98379

Estado: RecibidaSin puntuar—

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:

netfilter: ip6t_rpfilter: rechazar rutas sin inet6_dev

ip6_route_lookup() puede devolver una ruta sin errores cuya rt6i_idev es NULL. Reducir la MTU de un dispositivo de nexthop externo por debajo de IPV6_MIN_MTU destruye su inet6_dev mientras que fib6_ifdown() deja rutas usando objetos nexthop en la FIB. Un usuario sin privilegios puede construir este estado con rtnetlink en un espacio de nombres de usuario y red privado, luego desencadenar una desreferencia NULL a través de una búsqueda rpfilter IPv6:

Rechaza rutas sin un inet6_dev inmediatamente después de la búsqueda. Tales rutas no son elegibles para filtrado de ruta inversa, y la comprobación protege todas las desreferencias posteriores de rt6i_idev.

Detalles técnicos trazas, registros y código del informe original
  Oops: general protection fault, probably for non-canonical address
  0xdffffc0000000000
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)
  Call Trace:
  ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
  nf_hook_slow (net/netfilter/core.c:619)
  ipv6_rcv (net/ipv6/ip6_input.c:351)
  __netif_receive_skb_one_core (net/core/dev.c:6216)
  process_backlog (net/core/dev.c:6680)
  __napi_poll (net/core/dev.c:7739)
  net_rx_action (net/core/dev.c:7959)
  handle_softirqs (kernel/softirq.c:622)
  do_softirq.part.0 (kernel/softirq.c:523)
  __local_bh_enable_ip (kernel/softirq.c:450)
  __dev_queue_xmit (net/core/dev.c:4913)
  packet_sendmsg (net/packet/af_packet.c:3139)
  __sys_sendto (net/socket.c:2252)
  __x64_sys_sendto (net/socket.c:2259)
  do_syscall_64 (arch/x86/entry/syscall_64.c:94)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  Kernel panic - not syncing: Fatal exception in interrupt

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98379",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "f4de78756b0fddbd125b2b1b77c74f2eccc8e977",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "1681ab6dd1271f2f36047490793b78b1848bbcc9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "65487e9e99431ffcf05024a817f51ee4e3bd9b47",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "f49da48bd679cfee646d6a40dd02b1933de577d1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "eafe081ea77d25b5c8e601680671b4ecb4520e7d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "3a7384bc2e66217c9a01a392281334f4423740a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
              "lessThan": "1b9b5323725e458906c7620a3bc10398b51ad954",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/ipv6/netfilter/ip6t_rpfilter.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv6/netfilter/ip6t_rpfilter.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-09T08:16:56.250",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1681ab6dd1271f2f36047490793b78b1848bbcc9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1b9b5323725e458906c7620a3bc10398b51ad954",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3a7384bc2e66217c9a01a392281334f4423740a0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65487e9e99431ffcf05024a817f51ee4e3bd9b47",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eafe081ea77d25b5c8e601680671b4ecb4520e7d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f49da48bd679cfee646d6a40dd02b1933de577d1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f4de78756b0fddbd125b2b1b77c74f2eccc8e977",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject routes without inet6_dev\n\nip6_route_lookup() can return an error-free route whose rt6i_idev is\nNULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects\nin the FIB. An unprivileged user can construct this state with rtnetlink\nin a private user and network namespace, then trigger a NULL dereference\nthrough an IPv6 rpfilter lookup:\n\n  Oops: general protection fault, probably for non-canonical address\n  0xdffffc0000000000\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)\n  Call Trace:\n  ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)\n  nf_hook_slow (net/netfilter/core.c:619)\n  ipv6_rcv (net/ipv6/ip6_input.c:351)\n  __netif_receive_skb_one_core (net/core/dev.c:6216)\n  process_backlog (net/core/dev.c:6680)\n  __napi_poll (net/core/dev.c:7739)\n  net_rx_action (net/core/dev.c:7959)\n  handle_softirqs (kernel/softirq.c:622)\n  do_softirq.part.0 (kernel/softirq.c:523)\n  __local_bh_enable_ip (kernel/softirq.c:450)\n  __dev_queue_xmit (net/core/dev.c:4913)\n  packet_sendmsg (net/packet/af_packet.c:3139)\n  __sys_sendto (net/socket.c:2252)\n  __x64_sys_sendto (net/socket.c:2259)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nReject routes without an inet6_dev immediately after lookup. Such routes\nare not eligible for reverse-path filtering, and the check protects all\nlater rt6i_idev dereferences."
    }
  ],
  "lastModified": "2026-10-09T08:16:56.250",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}