{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43099", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.984Z", "datePublished": "2026-05-06T07:40:29.567Z", "dateUpdated": "2026-08-05T12:25:54.285Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:54.285Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \"No Such Interface\"." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable path is reached by an inbound IPv4 ICMP Extended Echo request processed by the kernel network stack. A remote host can send such ICMP packets to a target that has RFC 8335 probe replies enabled.\nAC:L - In the vulnerable deployment, a single well-formed ICMP probe with an IPv6 address identifier deterministically reaches the bad `dev_hold()` call. There is no race, heap shaping, or attacker-uncontrolled timing requirement.\nPR:N - The packet is processed before any authentication and does not require a local account or kernel capability from the attacker. The sysctl is a target configuration gate, not an attacker privilege requirement.\nUI:N - No victim user action is needed after the target is configured to answer ICMP probes. The attacker only sends a network packet.\nS:U - The impact is within the same kernel/network stack security authority. It does not cross a VM, sandbox, or hardware isolation boundary.\nC:N - The bug is an ERR_PTR/NULL-style dereference in `dev_hold()`, causing an oops rather than an information disclosure primitive. I found no evidence of attacker-controlled memory read.\nI:N - The invalid pointer is dereferenced for a reference count operation and is not a controllable write to a valid attacker-chosen object. This is a crash-only condition, not memory corruption enabling integrity modification.\nA:H - The invalid pointer dereference can crash the kernel, causing a high-impact denial of service. It is remotely repeatable against affected and configured systems." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/icmp.c" ], "versions": [ { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "0f21bc261e60f0c696c58841c4873ff77ed83673", "status": "affected", "versionType": "git" }, { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "dc5db4db19766a61ad65d81d1f55b1c1e51ba78d", "status": "affected", "versionType": "git" }, { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "47a8bf52156ac7e7a581eca31c1f964ba4258d4d", "status": "affected", "versionType": "git" }, { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "6be325206850a0891896d38bcf83a09d8b54ec48", "status": "affected", "versionType": "git" }, { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "f91b3ed9e7fa82a70511b5f6901c88379acf2964", "status": "affected", "versionType": "git" }, { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "5b9911582d441f72fe6ccb15ffe3303bbc07f6f5", "status": "affected", "versionType": "git" }, { "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "fde29fd9349327acc50d19a0b5f3d5a6c964dfd8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/icmp.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673" }, { "url": "https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d" }, { "url": "https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d" }, { "url": "https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48" }, { "url": "https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964" }, { "url": "https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5" }, { "url": "https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8" } ], "title": "ipv4: icmp: fix null-ptr-deref in icmp_build_probe()", "x_generator": { "engine": "bippy-1.2.0" } } } }