CVE-2026-23293

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled<br /> <br /> When booting with the &amp;#39;ipv6.disable=1&amp;#39; parameter, the nd_tbl is never<br /> initialized because inet6_init() exits before ndisc_init() is called<br /> which initializes it. If an IPv6 packet is injected into the interface,<br /> route_shortcircuit() is called and a NULL pointer dereference happens on<br /> neigh_lookup().<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000380<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> [...]<br /> RIP: 0010:neigh_lookup+0x20/0x270<br /> [...]<br /> Call Trace:<br /> <br /> vxlan_xmit+0x638/0x1ef0 [vxlan]<br /> dev_hard_start_xmit+0x9e/0x2e0<br /> __dev_queue_xmit+0xbee/0x14e0<br /> packet_sendmsg+0x116f/0x1930<br /> __sys_sendto+0x1f5/0x200<br /> __x64_sys_sendto+0x24/0x30<br /> do_syscall_64+0x12f/0x1590<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> Fix this by adding an early check on route_shortcircuit() when protocol<br /> is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because<br /> VXLAN can be built-in even when IPv6 is built as a module.