{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23439", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.017Z", "datePublished": "2026-04-03T15:15:23.734Z", "dateUpdated": "2026-04-03T15:15:23.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-03T15:15:23.734Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n\n\nWhen CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0\n(success) without actually creating a socket. Callers such as\nfou_create() then proceed to dereference the uninitialized socket\npointer, resulting in a NULL pointer dereference.\n\nThe captured NULL deref crash:\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)\n [...]\n Call Trace:\n <TASK>\n genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)\n genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n [...]\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n genl_rcv (net/netlink/genetlink.c:1219)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))\n __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))\n __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)\n\nThis patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so\ncallers correctly take their error paths. There is only one caller of\nthe vulnerable function and only privileged users can trigger it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/udp_tunnel.h"], "versions": [{"version": "fd384412e199b62c3ddaabd18dce86d0e164c5b9", "lessThan": "ba7c9ddcdd077942b798979edb035207374d4096", "status": "affected", "versionType": "git"}, {"version": "fd384412e199b62c3ddaabd18dce86d0e164c5b9", "lessThan": "a05a2149386f6dfb4245f522acdbef892acafc84", "status": "affected", "versionType": "git"}, {"version": "fd384412e199b62c3ddaabd18dce86d0e164c5b9", "lessThan": "9f036aa0fe46c19e938f03d10e02c23f4fffae5e", "status": "affected", "versionType": "git"}, {"version": "fd384412e199b62c3ddaabd18dce86d0e164c5b9", "lessThan": "003343985f26dfefd0c94b1fe1316a2de74428b9", "status": "affected", "versionType": "git"}, {"version": "fd384412e199b62c3ddaabd18dce86d0e164c5b9", "lessThan": "12aa4b73a67d95bc739995a2d6943aec2f9785c9", "status": "affected", "versionType": "git"}, {"version": "fd384412e199b62c3ddaabd18dce86d0e164c5b9", "lessThan": "b3a6df291fecf5f8a308953b65ca72b7fc9e015d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/udp_tunnel.h"], "versions": [{"version": "3.18", "status": "affected"}, {"version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.0-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba7c9ddcdd077942b798979edb035207374d4096"}, {"url": "https://git.kernel.org/stable/c/a05a2149386f6dfb4245f522acdbef892acafc84"}, {"url": "https://git.kernel.org/stable/c/9f036aa0fe46c19e938f03d10e02c23f4fffae5e"}, {"url": "https://git.kernel.org/stable/c/003343985f26dfefd0c94b1fe1316a2de74428b9"}, {"url": "https://git.kernel.org/stable/c/12aa4b73a67d95bc739995a2d6943aec2f9785c9"}, {"url": "https://git.kernel.org/stable/c/b3a6df291fecf5f8a308953b65ca72b7fc9e015d"}], "title": "udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n\n\nWhen CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0\n(success) without actually creating a socket. Callers such as\nfou_create() then proceed to dereference the uninitialized socket\npointer, resulting in a NULL pointer dereference.\n\nThe captured NULL deref crash:\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)\n [...]\n Call Trace:\n <TASK>\n genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)\n genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n [...]\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n genl_rcv (net/netlink/genetlink.c:1219)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))\n __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))\n __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)\n\nThis patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so\ncallers correctly take their error paths. There is only one caller of\nthe vulnerable function and only privileged users can trigger it."}], "id": "CVE-2026-23439", "lastModified": "2026-04-03T16:16:25.737", "metrics": {}, "published": "2026-04-03T16:16:25.737", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/003343985f26dfefd0c94b1fe1316a2de74428b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12aa4b73a67d95bc739995a2d6943aec2f9785c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f036aa0fe46c19e938f03d10e02c23f4fffae5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a05a2149386f6dfb4245f522acdbef892acafc84"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3a6df291fecf5f8a308953b65ca72b7fc9e015d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba7c9ddcdd077942b798979edb035207374d4096"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd384412e199b62c3ddaabd18dce86d0e164c5b9,ba7c9ddcdd077942b798979edb035207374d4096)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd384412e199b62c3ddaabd18dce86d0e164c5b9,a05a2149386f6dfb4245f522acdbef892acafc84)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd384412e199b62c3ddaabd18dce86d0e164c5b9,9f036aa0fe46c19e938f03d10e02c23f4fffae5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd384412e199b62c3ddaabd18dce86d0e164c5b9,003343985f26dfefd0c94b1fe1316a2de74428b9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd384412e199b62c3ddaabd18dce86d0e164c5b9,12aa4b73a67d95bc739995a2d6943aec2f9785c9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd384412e199b62c3ddaabd18dce86d0e164c5b9,b3a6df291fecf5f8a308953b65ca72b7fc9e015d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.18,3.18]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-03T18:56:35.228783+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that incorporates the udp_sock_create6 fix", "If the update is not possible, apply the upstream patch that causes udp_sock_create6 to return -EPFNOSUPPORT when IPv6 is disabled", "Verify that no applications rely on the deprecated IPv6 path before applying the patch"], "summary": {"action": "Patch", "impact": "Kernel crash from null pointer dereference"}, "threat_synthesis": {"affected_systems": "All Linux kernels compiled with the configuration option CONFIG_IPV6 set to \"n\" are affected. The list of vendors includes the standard Linux kernel build, and no specific version ranges are noted, which means any kernel built in that manner remains vulnerable until the patch is applied.", "description_and_impact": "The Linux kernel has a flaw that appears when IPv6 support is disabled. In that configuration the socket creation routine for IPv6 reports success but does not actually return a socket, leaving the caller with a null pointer. When a function later attempts to use that pointer, the kernel dereferences it, causing a null pointer fault and a kernel panic. This crash results in a denial of service, requiring a reboot to recover.", "risk_and_exploitability": "The vulnerability can only be exercised through privileged netlink and socket interfaces, implying that a local user with elevated rights can trigger the crash. No public exploit has been announced; the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. Although exploitation requires local privilege, the single crash can take a whole system down, so the risk is significant for the affected installations."}}}}, "created": "2026-04-03T21:13:59.138121+00:00", "updated": "2026-04-03T21:16:12.420491+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}