cbcvebase.
CVE-2026-23439
published 2026-04-03

CVE-2026-23439: In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.9th percentile
In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference the uninitialized socket pointer, resulting in a NULL pointer dereference. The captured NULL deref crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764) [...] Call Trace: genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209) [...] netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1)) __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1)) __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130) This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so callers correctly take their error paths. There is only one caller of the vulnerable function and only privileged users can trigger it.

Affected

63 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.19.10-1 (forky)linux 6.19.10-1 (forky)
linuxlinux
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < dfc96ae0074cc47b5478a59e5aa19233e434243fdfc96ae0074cc47b5478a59e5aa19233e434243f
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < 66117dbb3dbae82f86735bf727b1d59cc677afa166117dbb3dbae82f86735bf727b1d59cc677afa1
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < ba7c9ddcdd077942b798979edb035207374d4096ba7c9ddcdd077942b798979edb035207374d4096
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < a05a2149386f6dfb4245f522acdbef892acafc84a05a2149386f6dfb4245f522acdbef892acafc84
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < 9f036aa0fe46c19e938f03d10e02c23f4fffae5e9f036aa0fe46c19e938f03d10e02c23f4fffae5e
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < 003343985f26dfefd0c94b1fe1316a2de74428b9003343985f26dfefd0c94b1fe1316a2de74428b9
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < 12aa4b73a67d95bc739995a2d6943aec2f9785c912aa4b73a67d95bc739995a2d6943aec2f9785c9
linuxlinux>= fd384412e199b62c3ddaabd18dce86d0e164c5b9 < b3a6df291fecf5f8a308953b65ca72b7fc9e015db3a6df291fecf5f8a308953b65ca72b7fc9e015d
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.19.10-16.19.10-1
linuxlinux_kernel>= 3.18.1 < 5.10.2535.10.253
linuxlinux_kernel>= 5.11 < 5.15.2035.15.203
linuxlinux_kernel>= 5.16 < 6.1.1676.1.167
linuxlinux_kernel>= 6.13 < 6.18.206.18.20
linuxlinux_kernel>= 6.19 < 6.19.106.19.10
linuxlinux_kernel>= 6.2 < 6.6.1306.6.130

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.1HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.