SB2026111106 - NULL pointer dereference in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99288)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel NULL pointer dereference and panic.

The vulnerability exists due to a race condition leading to a null pointer dereference in the Linux kernel TCP established-socket lookup functions __inet_lookup_established() and __inet6_lookup_established() when processing TCP traffic concurrently with socket memory reuse. A remote attacker can send TCP traffic that triggers reuse of a socket address with the same connection tuple, causing a lookup to return an unhashed request socket and subsequently dereference its null listener pointer to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd
• https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6
• https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879