CVE-2026-64542: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-64542DEBIAN-CVE-2026-64542
Published 27-07-2026Last modified 19-08-2026
Open JSON

Vulnerability summary

CVE-2026-64542 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.2% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 18 · Related 16
MGASA-2026-0336MGASA-2026-0337OPENSUSE-SU-2026:11476-1OPENSUSE-SU-2026:21910-1SUSE-SU-2026:23881-1SUSE-SU-2026:23887-1

Timeline

  1. 27-07-2026
    PublishedVulnerability first disclosed.
  2. 19-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check, even though its only caller ndisc_recv_na() already fetched and NULL-checked idev for the same device. Both reads of dev->ip6_ptr run in the same RCU read-side critical section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchronize_net() that orders the unregister path, so the re-fetch returns NULL and oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974) Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndisc_recv_na (net/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_input.c:534) ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_input.c:635) ipv6_rcv (net/ipv6/ip6_input.c:351) </IRQ> It is reachable by an unprivileged user via a network namespace. Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev->ip6_ptr has been cleared.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

0.00 pp

From 0.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu142 products
  • linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-38.38
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1014.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.100-1 | < 7.1.5-1
  • linux-6.12< 6.12.100-1~deb12u1
Linux1 product
  • linux≥ aaa5f515b16b6b3e137779ffb4c9558bb58c1e75, < e5ba3017e46f275ad347e762e8eecacec5efa41d | ≥ aaa5f515b16b6b3e137779ffb4c9558bb58c1e75, < 160d3f0d7a556ceae505dcab521a37057b4ce28f | ≥ aaa5f515b16b6b3e137779ffb4c9558bb58c1e75, < 62c719203cb521b64fab74da94a81bdde5c18808 | ≥ aaa5f515b16b6b3e137779ffb4c9558bb58c1e75, < a6450f7cfae57b382cbaf66a577765c9a88b3c58 | ≥ aaa5f515b16b6b3e137779ffb4c9558bb58c1e75, < 63d1c23764de2309cedbb779c75188d257a09d9b | ≥ aaa5f515b16b6b3e137779ffb4c9558bb58c1e75, < d186e942365acece7c56d39da05dd63bf95b280a | 6.0

3 vendors · 145 products

References

19 links
Show all 19 references