Null Pointer Dereference in Linux Kernel Affecting Networking Functionality

CVE-2026-43441

What is CVE-2026-43441?

A vulnerability in the Linux kernel's bonding driver can lead to a null pointer dereference when running with IPv6 disabled. This occurs if the system is booted with the 'ipv6.disable=1' parameter. The initialization routine for IPv6 fails to set up necessary structures, resulting in potential crashes during packet validation. Specifically, when bonding ARP/NS validation is enabled, a received IPv6 Neighbor Solicitation or Advertisement can cause the system to crash, as critical checks are made on uninitialized memory. The vulnerability can be mitigated by ensuring checks for IPv6 module status prior to processing related packets.

References