Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23381— net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致内核崩溃。

AI Predicted 5.3 Difficulty: Moderate EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux ed842faeb2bd49256f00485402f3113205f91d30< a9d712ccfeef737c0e700a4b5b98f310e07b6b60 affected
ed842faeb2bd49256f00485402f3113205f91d30< a5c56e65b685360dd3f2278aeff8c21061feb665 affected
ed842faeb2bd49256f00485402f3113205f91d30< 7a894eb5de246d79f13105c55a67381039a24d44 affected
ed842faeb2bd49256f00485402f3113205f91d30< a12cdaa3375f0bd3c8f4e564be7c143529abfe5b affected
ed842faeb2bd49256f00485402f3113205f91d30< aa73deb3b6b730ec280d45b3f423bfa9e17bc122 affected
ed842faeb2bd49256f00485402f3113205f91d30< 33dec6f10777d5a8f71c0a200f690da5ae3c2e55 affected
ed842faeb2bd49256f00485402f3113205f91d30< 20ef5c25422f97dd09d751e5ae6c18406cdc78e6 affected
ed842faeb2bd49256f00485402f3113205f91d30< e5e890630533bdc15b26a34bb8e7ef539bdf1322 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23381

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. Then, if neigh_suppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will dereference ipv6_stub->nd_tbl which is NULL, passing it to neigh_lookup(). This causes a kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000268 Oops: 0000 [#1] PREEMPT SMP NOPTI [...] RIP: 0010:neigh_lookup+0x16/0xe0 [...] Call Trace: <IRQ> ? neigh_lookup+0x16/0xe0 br_do_suppress_nd+0x160/0x290 [bridge] br_handle_frame_finish+0x500/0x620 [bridge] br_handle_frame+0x353/0x440 [bridge] __netif_receive_skb_core.constprop.0+0x298/0x1110 __netif_receive_skb_one_core+0x3d/0xa0 process_backlog+0xa0/0x140 __napi_poll+0x2c/0x170 net_rx_action+0x2c4/0x3a0 handle_softirqs+0xd0/0x270 do_softirq+0x3f/0x60 Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in the callers. This is in essence disabling NS/NA suppression when IPv6 is disabled.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ed842faeb2bd49256f00485402f3113205f91d30 ~ a9d712ccfeef737c0e700a4b5b98f310e07b6b60 -
Linux Linux 4.15 -

II. Public POCs for CVE-2026-23381

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23381

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23381 (6)

Same Patch Batch · Linux · 2026-03-25 · 116 CVEs total

CVE-2026-23395 8.8 HIGH Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
CVE-2026-31788 8.2 HIGH xen/privcmd: restrict usage in unprivileged domU
CVE-2026-23340 7.8 HIGH net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
CVE-2026-23336 7.8 HIGH wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
CVE-2026-23350 7.8 HIGH drm/xe/queue: Call fini on exec queue creation fail
CVE-2026-23351 7.8 HIGH netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
CVE-2026-23317 7.8 HIGH drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
CVE-2026-23306 7.8 HIGH scsi: pm8001: Fix use-after-free in pm8001_queue_command()
CVE-2026-23372 7.8 HIGH nfc: rawsock: cancel tx_work before socket teardown
CVE-2026-23378 7.8 HIGH net/sched: act_ife: Fix metalist update behavior
CVE-2026-23383 7.8 HIGH bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
CVE-2026-23391 7.8 HIGH netfilter: xt_CT: drop pending enqueued packets on template removal
CVE-2026-23392 7.8 HIGH netfilter: nf_tables: release flowtable after rcu grace period on error
CVE-2026-23393 7.8 HIGH bridge: cfm: Fix race condition in peer_mep deletion
CVE-2026-23280 7.8 HIGH accel/amdxdna: Prevent ubuf size overflow
CVE-2026-23288 7.8 HIGH accel/amdxdna: Fix out-of-bounds memset in command slot handling
CVE-2026-23364 7.4 HIGH ksmbd: Compare MACs in constant time
CVE-2026-23294 7.0 HIGH bpf: Fix race in devmap on PREEMPT_RT
CVE-2026-23352 x86/efi: defer freeing of boot services memory
CVE-2026-23354 x86/fred: Correct speculative safety in fred_extint()

Showing top 20 of 116 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23381

No comments yet

Leave a comment