ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing this error pointer to dev_hold() will cause a kernel crash with null-ptr-deref. Instead, silently discard the request. RFC 8335 does not appear to define a specific response for the case where an IPv6 interface identifier is syntactically valid but the implementation cannot perform the lookup at runtime, and silently dropping the request may safer than misreporting "No Such Interface".
CVE-2026-43099
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43099
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "0f21bc261e60f0c696c58841c4873ff77ed83673",
"versionType": "git"
},
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "dc5db4db19766a61ad65d81d1f55b1c1e51ba78d",
"versionType": "git"
},
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "47a8bf52156ac7e7a581eca31c1f964ba4258d4d",
"versionType": "git"
},
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "6be325206850a0891896d38bcf83a09d8b54ec48",
"versionType": "git"
},
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "f91b3ed9e7fa82a70511b5f6901c88379acf2964",
"versionType": "git"
},
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "5b9911582d441f72fe6ccb15ffe3303bbc07f6f5",
"versionType": "git"
},
{
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"lessThan": "fde29fd9349327acc50d19a0b5f3d5a6c964dfd8",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/icmp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/icmp.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-43099
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28348 · Revision 1
- Added to Heist Feed
- Publisher date