CVE-2026-64542
N/A ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->cnf.accept_untracked_na without a NULL check, even though its only caller ndisc_recv_na() already fetched and NULL-checked idev for the same device. Both reads of dev->ip6_ptr run in the same RCU read-side critical section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchronize_net() that orders the unregister path, so the re-fetch returns NULL and oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974) Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndisc_recv_na (net/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_input.c:534) ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_input.c:635) ipv6_rcv (net/ipv6/ip6_input.c:351) </IRQ> It is reachable by an unprivileged user via a network namespace. Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev->ip6_ptr has been cleared.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 7th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
References and research data (JSON)
Vendor product assessments
Showing 32 of 274 vendor product statements; 242 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-64k-debug-devel-matched as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-devel-matched
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-debug-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-debug-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-uki-virt
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-modules-extra as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-rt-64k-debug-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-rt-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-rt-debug-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-rt-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-tools-libs as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-tools-libs
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
libperf as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libperf
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-whitelists
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
kernel-firmware as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-firmware
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
python-perf as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python-perf
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- no fix planned: Will not fix
bpftool as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-debug as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools-libs-devel
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-debug-modules as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-debug as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-selftests-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-selftests-internal
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel.src as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-debug-modules-core
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-cross-headers as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-cross-headers
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-devel as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-64k-core as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-core
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-64k-devel-matched as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-devel-matched
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-kvm
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-rt-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-partner
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00kernel-zfcpdump-devel-matched as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel-matched
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00rv as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rv
Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64542.json Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49593 EUVD · EUVD-2026-49593
Technical & other
- https://git.kernel.org/stable/c/e5ba3017e46f275ad347e762e8eecacec5efa41dCVE record · Linux · Updated 2026-08-19T16:28:25.885Z
NVD · CVE-2026-64542 · Updated 2026-08-19T17:20:15.523 - https://git.kernel.org/stable/c/160d3f0d7a556ceae505dcab521a37057b4ce28fCVE record · Linux · Updated 2026-08-19T16:28:25.885Z
NVD · CVE-2026-64542 · Updated 2026-08-19T17:20:15.523 - https://git.kernel.org/stable/c/62c719203cb521b64fab74da94a81bdde5c18808CVE record · Linux · Updated 2026-08-19T16:28:25.885Z
NVD · CVE-2026-64542 · Updated 2026-08-19T17:20:15.523 - https://git.kernel.org/stable/c/a6450f7cfae57b382cbaf66a577765c9a88b3c58CVE record · Linux · Updated 2026-08-19T16:28:25.885Z
NVD · CVE-2026-64542 · Updated 2026-08-19T17:20:15.523 - https://git.kernel.org/stable/c/63d1c23764de2309cedbb779c75188d257a09d9bCVE record · Linux · Updated 2026-08-19T16:28:25.885Z
NVD · CVE-2026-64542 · Updated 2026-08-19T17:20:15.523 - https://git.kernel.org/stable/c/d186e942365acece7c56d39da05dd63bf95b280aCVE record · Linux · Updated 2026-08-19T16:28:25.885Z
NVD · CVE-2026-64542 · Updated 2026-08-19T17:20:15.523 - https://access.redhat.com/security/cve/CVE-2026-64542 Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2507809 Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-64542 Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-64542 Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
- https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64542-fe95@gregkh/T Red Hat · CVE-2026-64542 · Updated 2026-08-14T18:44:36+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS