Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53012— nexthop: fix IPv6 route referencing IPv4 nexthop

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 5.3版本存在安全漏洞，该漏洞源于IPv6路由替换IPv4 nexthop时nh_group_v4_update未正确更新，可能导致空指针取消引用。

AI Predicted 8.4 Difficulty: Easy EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1498.002 · Reflection Amplification

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 7bf4796dd09984ad1612877a82d0d139c70ae27f< ceffe81a0be92afc0cd1340bc8ca46559cce9bb4 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< 9c2d6770a5f4545a307eb66979bef7656a34d621 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< 6275796f22bb382f3e9aa58ed0b4ef7bdad78cb8 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< aaac3bed034239e1d75732211d9b05f30b0b4f35 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< ad85961004fd4bd2f31209ac4b07612c6cefb9e7 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< 613c8f4a501421dd258b07ea614205d4e16ec845 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< b3b7e850e1541f0520c4a12ec884255c30427ff6 affected
7bf4796dd09984ad1612877a82d0d139c70ae27f< 29c95185ba32b621fbc3800fb86e7dc3edf5c2be affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53012

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nexthop: fix IPv6 route referencing IPv4 nexthop
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nexthop: fix IPv6 route referencing IPv4 nexthop syzbot reported a panic [1] [2]. When an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag of all groups containing this nexthop is not updated. This is because nh_group_v4_update is only called when replacing AF_INET to AF_INET6, but the reverse direction (AF_INET6 to AF_INET) is missed. This allows a stale has_v4=false to bypass fib6_check_nexthop, causing IPv6 routes to be attached to groups that effectively contain only AF_INET members. Subsequent route lookups then call nexthop_fib6_nh() which returns NULL for the AF_INET member, leading to a NULL pointer dereference. Fix by calling nh_group_v4_update whenever the family changes, not just AF_INET to AF_INET6. Reproducer: # AF_INET6 blackhole ip -6 nexthop add id 1 blackhole # group with has_v4=false ip nexthop add id 100 group 1 # replace with AF_INET (no -6), has_v4 stays false ip nexthop replace id 1 blackhole # pass stale has_v4 check ip -6 route add 2001:db8::/64 nhid 100 # panic ping -6 2001:db8::1 [1] https://syzkaller.appspot.com/bug?id=e17283eb2f8dcf3dd9b47fe6f67a95f71faadad0 [2] https://syzkaller.appspot.com/bug?id=8699b6ae54c9f35837d925686208402949e12ef3
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel 5.3版本存在安全漏洞，该漏洞源于IPv6路由替换IPv4 nexthop时nh_group_v4_update未正确更新，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7bf4796dd09984ad1612877a82d0d139c70ae27f ~ ceffe81a0be92afc0cd1340bc8ca46559cce9bb4 -
Linux Linux 5.3 -

II. Public POCs for CVE-2026-53012

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53012

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53012 (8)

Same Patch Batch · Linux · 2026-06-24 · 219 CVEs total

CVE-2026-53049 9.8 CRITICAL gfs2: add some missing log locking
CVE-2026-52993 9.8 CRITICAL tipc: fix double-free in tipc_buf_append()
CVE-2026-52989 9.8 CRITICAL nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
CVE-2026-52986 9.8 CRITICAL netfilter: nf_conntrack_sip: don't use simple_strtoul
CVE-2026-52982 9.8 CRITICAL net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
CVE-2026-53002 9.8 CRITICAL netfilter: conntrack: remove sprintf usage
CVE-2026-53006 9.8 CRITICAL ipv6: fix possible UAF in icmpv6_rcv()
CVE-2026-53045 9.8 CRITICAL memory: tegra124-emc: Fix dll_change check
CVE-2026-53086 9.8 CRITICAL net: bcmgenet: fix racing timeout handler
CVE-2026-53046 9.8 CRITICAL ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
CVE-2026-52955 9.8 CRITICAL libceph: Fix potential out-of-bounds access in crush_decode()
CVE-2026-53010 9.8 CRITICAL ksmbd: fix use-after-free in smb2_open during durable reconnect
CVE-2026-53088 9.8 CRITICAL net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
CVE-2026-52914 9.8 CRITICAL batman-adv: fix fragment reassembly length accounting
CVE-2026-53055 9.8 CRITICAL crypto: hisilicon/sec2 - prevent req used-after-free for sec
CVE-2026-52924 9.8 CRITICAL sctp: purge outqueue on stale COOKIE-ECHO handling
CVE-2026-52931 9.8 CRITICAL batman-adv: tp_meter: avoid use of uninit sender vars
CVE-2026-52999 9.1 CRITICAL netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
CVE-2026-53043 9.1 CRITICAL ocfs2/dlm: validate qr_numregions in dlm_match_regions()
CVE-2026-52958 9.1 CRITICAL libceph: Fix potential out-of-bounds access in osdmap_decode()

Showing top 20 of 219 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53012

No comments yet

Leave a comment