CVE-2026-98379— netfilter: ip6t_rpfilter: reject routes without inet6_dev
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： netfilter: ip6t_rpfilter：拒绝没有 inet6_dev 的路由 可能返回一个无错误但 字段为 NULL 的路由条目。当某个外层下一跳（nexthop）设备的 MTU 被降低至低于 时，会触发 清理该设备的 ，但此时使用这些下一跳对象的路由在 FIB（Forwarding Information Base，转发信息库）中仍未被清除。 特权级别较低的用户可以通过 在私有用户命名空间和网络命名空间中构造出上述状态，随后触发 IPv6 rpfilter（逆向
Possible ATT&CK Techniques 1 AI
T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98379
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rpfilter: reject routes without inet6_dev
ip6_route_lookup() can return an error-free route whose rt6i_idev is
NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears
down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects
in the FIB. An unprivileged user can construct this state with rtnetlink
in a private user and network namespace, then trigger a NULL dereference
through an IPv6 rpfilter lookup:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)
Call Trace:
ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
nf_hook_slow (net/netfilter/core.c:619)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6216)
process_backlog (net/core/dev.c:6680)
__napi_poll (net/core/dev.c:7739)
net_rx_action (net/core/dev.c:7959)
handle_softirqs (kernel/softirq.c:622)
do_softirq.part.0 (kernel/softirq.c:523)
__local_bh_enable_ip (kernel/softirq.c:450)
__dev_queue_xmit (net/core/dev.c:4913)
packet_sendmsg (net/packet/af_packet.c:3139)
__sys_sendto (net/socket.c:2252)
__x64_sys_sendto (net/socket.c:2259)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Reject routes without an inet6_dev immediately after lookup. Such routes
are not eligible for reverse-path filtering, and the check protects all
later rt6i_idev dereferences.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98379
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98379
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98379 (8)
Same Patch Batch · Linux · 2026-10-09 · 10 CVEs total
| CVE-2026-98384 | bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() | |
| CVE-2026-98383 | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | |
| CVE-2026-98382 | bpf: Reject dev-bound-only programs on other devices | |
| CVE-2026-98381 | veth: manage XDP program pointers during channel resize | |
| CVE-2026-98380 | net/sched: reject IDR error pointers when deleting actions | |
| CVE-2026-98378 | bpf: Skip unsettled links in link iterator | |
| CVE-2026-98377 | vlan: require the MAC header to be present in __vlan_insert_inner_tag() | |
| CVE-2026-98376 | bpf: Use array_map_meta_equal for percpu array inner map replacement | |
| CVE-2026-98375 | xen/netfront: drop RX packets with a short Ethernet header |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-98379
No comments yet