medium 5.5

CVE-2026-23381 json

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

published 2026-03-25 7 mo ago modified 2026-11-05 3 d ago also EUVD-2026-15374

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. Then, if neigh_suppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will dereference ipv6_stub->nd_tbl which is NULL, passing it to neigh_lookup(). This causes a kernel NULL pointer dereference.

BUG: kernel NULL pointer dereference, address: 0000000000000268 Oops: 0000 [#1] PREEMPT SMP NOPTI [...] RIP: 0010:neigh_lookup+0x16/0xe0 [...] Call Trace: <IRQ> ? neigh_lookup+0x16/0xe0 br_do_suppress_nd+0x160/0x290 [bridge] br_handle_frame_finish+0x500/0x620 [bridge] br_handle_frame+0x353/0x440 [bridge] __netif_receive_skb_core.constprop.0+0x298/0x1110 __netif_receive_skb_one_core+0x3d/0xa0 process_backlog+0xa0/0x140 __napi_poll+0x2c/0x170 net_rx_action+0x2c4/0x3a0 handle_softirqs+0xd0/0x270 do_softirq+0x3f/0x60

Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in the callers. This is in essence disabling NS/NA suppression when IPv6 is disabled.

Patch / fix

fixed in 1 distros 6 links 8

Linux Linux 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, 7.0

debian ubuntu red hat suse opensuse azure linux

linux Debian 12 6.1.170-1
linux Debian 13 6.12.85-1
linux Debian 14 6.19.8-1

debian advisories DEBIAN-CVE-2026-23381

linux Ubuntu 22.04 LTS 5.15.0-186.196
linux Ubuntu 24.04 LTS 6.8.0-136.136
linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72
linux-gke Ubuntu 22.04 LTS 5.15.0-1108.114
linux-gke Ubuntu 24.04 LTS 6.8.0-1059.67

ubuntu advisories UBUNTU-CVE-2026-23381

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

runc RHEL 9.2 E4S 4:1.2.9-1.el9_2.2

red hat advisories RHSA-2026:25253

kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.37.2
kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.37.1
kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.37.2
kernel-rt Linux Micro 6.2 6.12.0-160000.28.1
kernel-64kb Linux Micro 6.2 6.12.0-160000.28.1
kernel-source Linux Micro 6.2 6.12.0-160000.28.1
kernel-default Linux Micro 6.2 6.12.0-160000.28.1
kernel-default-base Linux Micro 6.2 6.12.0-160000.27.1.160000.2.8

suse advisories SUSE-SU-2026:1573-1 SUSE-SU-2026:21237-1 SUSE-SU-2026:21230-1 SUSE-SU-2026:21255-1 SUSE-SU-2026:21123-1 SUSE-SU-2026:21114-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.28.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.28.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.28.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.28.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.28.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.28.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.28.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.28.1

opensuse advisories openSUSE-SU-2026:20572-1

kernel Azure Linux 3.0 6.6.130.1-1

azure linux advisories AZL-80702

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-23381 updated 2026-11-05 cvss 5.5

kernel: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Do not use the ipv6.disable=1 boot parameter on systems using network bridging with neighbor suppression, or disable neigh_suppress on bridges when IPv6 is disabled.”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: workaround, no fix available “Do not use the ipv6.disable=1 boot parameter on systems using network bridging with neighbor suppression, or disable neigh_suppress on bridges when IPv6 is disabled.”
Red Hat Enterprise Linux AppStream E4S (v.9.2) runc 1.2.9-1.el9_2.2
fixed: vendor fix “Do not use the ipv6.disable=1 boot parameter on systems using network bridging with neighbor suppression, or disable neigh_suppress on bridges when IPv6 is disabled.” RHSA-2026:25253
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-11 updated 2026-10-22 cvss 5.5

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.7 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.7
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-295-16 updated 2026-10-22 cvss 5.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-209-04 updated 2026-07-28 cvss 5.5

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.6 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.6
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 d ago (2026-11-05)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-23381
NVD CVE-2026-23381

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix

Vendor advisories

CISA SSVC

Exploit prediction

CVSS scores

Affected products

Classification

References

Sources