CVE-2026-68336bonding: fix devconf_all NULL dereference when IPv6 is disabled
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconf_all NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route(). BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by adding ipv6_mod_enabled() condition check in the caller.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 451c2d5422a309393aa8ae161fc1a527c2f19ab2; 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 builds before 2a4bad24ac5296b262ad821aa5e08bb265e6b154; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 690ce66782778e8c4b1fdd79c0b0890a100e9522; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 992dce02bdabbd9883255ea9b36494e34a7821d7; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 before 738039ad21e20ca2c5bbde2f5a4f5ad5fb718038; 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7 builds before 1c975de3343cdef506f2eecc833cc1f14b0401c4 | CNA record |
References
- https://git.kernel.org/stable/c/451c2d5422a309393aa8ae161fc1a527c2f19ab2
- https://git.kernel.org/stable/c/2a4bad24ac5296b262ad821aa5e08bb265e6b154
- https://git.kernel.org/stable/c/690ce66782778e8c4b1fdd79c0b0890a100e9522
- https://git.kernel.org/stable/c/992dce02bdabbd9883255ea9b36494e34a7821d7
- https://git.kernel.org/stable/c/738039ad21e20ca2c5bbde2f5a4f5ad5fb718038
- https://git.kernel.org/stable/c/1c975de3343cdef506f2eecc833cc1f14b0401c4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.