CVE-2026-53214

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: Fix a potential NPD in cleanup_prefix_route()<br /> <br /> addrconf_get_prefix_route() can return the fib6_null_entry sentinel<br /> entry which has a NULL fib6_table pointer. Therefore, before setting the<br /> route&amp;#39;s expiration time, check that we are not working with this entry,<br /> as otherwise a NPD will be triggered [1].<br /> <br /> Note that the other callers of addrconf_get_prefix_route() are not<br /> susceptible to this bug:<br /> <br /> 1. addrconf_prefix_rcv(): Requests a route with the &amp;#39;RTF_ADDRCONF |<br /> RTF_PREFIX_RT&amp;#39; flags which are not set on fib6_null_entry.<br /> <br /> 2. modify_prefix_route(): Fixed by commit a747e02430df ("ipv6: avoid<br /> possible NULL deref in modify_prefix_route()").<br /> <br /> 3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for<br /> fib6_null_entry and returns an error.<br /> <br /> [1]<br /> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN<br /> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]<br /> [...]<br /> Call Trace:<br /> <br /> __kasan_check_byte (mm/kasan/common.c:573)<br /> lock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1))<br /> _raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1))<br /> cleanup_prefix_route (net/ipv6/addrconf.c:1280)<br /> ipv6_del_addr (net/ipv6/addrconf.c:1342)<br /> inet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119)<br /> inet6_rtm_deladdr (net/ipv6/addrconf.c:4812)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:6997)<br /> netlink_rcv_skb (net/netlink/af_netlink.c:2555)<br /> netlink_unicast (net/netlink/af_netlink.c:1344)<br /> netlink_sendmsg (net/netlink/af_netlink.c:1899)<br /> __sock_sendmsg (net/socket.c:802 (discriminator 4))<br /> ____sys_sendmsg (net/socket.c:2698)<br /> ___sys_sendmsg (net/socket.c:2752)<br /> __sys_sendmsg (net/socket.c:2784)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)