CVE-2026-64569

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n<br /> <br /> On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed<br /> attribute table itself instead of calling ip_valid_fib_dump_req(). The<br /> RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is<br /> present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no<br /> RTA_OIF hits a NULL dereference.<br /> <br /> RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without<br /> CAP_NET_ADMIN, so an unprivileged user can trigger it.<br /> <br /> Oops: general protection fault, probably for non-canonical address<br /> 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI<br /> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]<br /> RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)<br /> Call Trace:<br /> mpls_dump_routes (net/mpls/af_mpls.c:2236)<br /> netlink_dump (net/netlink/af_netlink.c:2331)<br /> __netlink_dump_start (net/netlink/af_netlink.c:2446)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)<br /> netlink_rcv_skb (net/netlink/af_netlink.c:2556)<br /> netlink_unicast (net/netlink/af_netlink.c:1345)<br /> netlink_sendmsg (net/netlink/af_netlink.c:1900)<br /> __sock_sendmsg (net/socket.c:790)<br /> ____sys_sendmsg (net/socket.c:2684)<br /> ___sys_sendmsg (net/socket.c:2738)<br /> __sys_sendmsg (net/socket.c:2770)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)<br /> <br /> Skip unset attributes, as ip_valid_fib_dump_req() does.