Answer in brief
CVE-2026-89561 records a High severity (CVSS 7.5) vulnerability in ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <eab3a917cdcb182542a3aac6a0d2d30659ca9821 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <f826df95332c07380206dbd54178b6eefb311aba | 63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c, eab3a917cdcb182542a3aac6a0d2d30659ca9821, f826df95332c07380206dbd54178b6eefb311aba |
| Linux/Linuxgeneric | 5.7 | Not reported |
| Linux/Linuxgeneric | >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <e7123e10c86eb88eaa90537dd1f232706de2d308 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <eab3a917cdcb182542a3aac6a0d2d30659ca9821 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <f826df95332c07380206dbd54178b6eefb311aba | e7123e10c86eb88eaa90537dd1f232706de2d308, 63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c, eab3a917cdcb182542a3aac6a0d2d30659ca9821, f826df95332c07380206dbd54178b6eefb311aba |
| Linux/Linuxgeneric | >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <62b63a505c10e8db76017ef73c0b243e0dc5d288 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <e7123e10c86eb88eaa90537dd1f232706de2d308 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <eab3a917cdcb182542a3aac6a0d2d30659ca9821 || >=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 <f826df95332c07380206dbd54178b6eefb311aba | 62b63a505c10e8db76017ef73c0b243e0dc5d288, e7123e10c86eb88eaa90537dd1f232706de2d308, 63f50e9f90d0287ad66a0955ebfc2d3a9c044a1c, eab3a917cdcb182542a3aac6a0d2d30659ca9821, f826df95332c07380206dbd54178b6eefb311aba |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl_seg_enabled. When the device's MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL. Reproduced by flooding the receiving interface with ping6 traffic while flapping its MTU between 1500 and 1200: BUG: KASAN: null-ptr-deref in ipv6_rpl_srh_rcv+0xb3/0x1070 Read of size 4 at addr 00000000000006b4 by task ping6/394 CPU: 2 UID: 0 PID: 394 Comm: ping6 Not tainted 7.2.0-rc7-micro-vm-dev-00095-g24ef02f934ee #240 PREEMPT(full) Call Trace: <IRQ> kasan_report+0xc6/0x100 ipv6_rpl_srh_rcv+0xb3/0x1070 ip6_protocol_deliver_rcu+0x759/0x9a0 ip6_input_finish+0xa8/0x1b0 ip6_input+0xe1/0x490 ipv6_rcv+0x33d/0x460 __netif_receive_skb_one_core+0xd6/0x130 process_backlog+0x2cc/0xa00 __napi_poll.constprop.0+0x56/0x270 net_rx_action+0x327/0x730 handle_softirqs+0x11e/0x630 do_softirq+0xb3/0xf0 </IRQ> Both ipv6_rpl_srh_rcv() and ipv6_srh_rcv() are called only from ipv6_rthdr_rcv(), which already has an idev lookup. Fix the NULL dereference on the RPL path by checking idev in ipv6_rthdr_rcv(), before it calls either function. The callees take idev as an argument and no longer call __in6_dev_get(), so the packet is now dropped in one place, with SKB_DROP_REASON_IPV6DISABLED on both paths.
Quoted source text, attributed separately from HOL analysis.