CVE-2026-98379

Executive Summary

CVE-2026-98379 is a NULL pointer dereference vulnerability in the Linux kernel's netfilter ip6t_rpfilter reverse path filter. An unprivileged local user can construct a state where ip6_route_lookup() returns an error-free route with a NULL rt6i_idev by lowering an external nexthop device's MTU below IPV6_MIN_MTU in a private user and network namespace, then trigger a kernel panic through an IPv6 rpfilter lookup. The vulnerability is confined to IPv6 netfilter packet filtering and affects systems where unprivileged user namespaces are enabled; the immediate impact is a denial of service (kernel panic), though the NULL dereference class could theoretically be leveraged for further exploitation depending on kernel configuration.

Technical Analysis

The vulnerability resides in the rpfilter_mt function in net/ipv6/netfilter/ip6t_rpfilter.c at line 75. The ip6t_rpfilter module implements IPv6 reverse path filtering (rpfilter), a netfilter match that validates whether an incoming packet's source address is reachable via the interface it arrived on. This is a classic anti-spoofing control.

The mechanism is as follows. The ip6_route_lookup() function can return a route that has no error status but whose rt6i_idev (the inet6_dev pointer associated with the route's output interface) is NULL. This state is reachable when an external nexthop device's MTU is lowered below IPV6_MIN_MTU. When this MTU change occurs, the kernel tears down the interface's inet6_dev structure. However, fib6_ifdown() — the function responsible for removing routes when an interface goes down — leaves routes that use nexthop objects in the FIB (Forwarding Information Base). The result is a FIB entry that points to a device whose inet6_dev has been destroyed, so rt6i_idev becomes NULL.

An unprivileged user can construct this exact state using rtnetlink within a private user and network namespace. No special privileges beyond the ability to create user/network namespaces are required. Once the state exists, an IPv6 packet that triggers a reverse path filter lookup causes rpfilter_mt to dereference the NULL rt6i_idev pointer.

The crash signature reported is:

• Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000
• KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
• RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)

The call trace shows the packet path: packet_sendmsg (AF_PACKET socket) → __dev_queue_xmit → softirq processing → ipv6_rcv → nf_hook_slow → ip6t_do_table → rpfilter_mt. The packet is injected via an AF_PACKET socket, looped through the network stack, and hits the vulnerable ip6tables rpfilter match. The kernel then panics with "Kernel panic - not syncing: Fa" (truncated, likely "Fatal exception").

The attack surface is local. The rpfilter match must be configured in an ip6tables rule chain to be reachable. The NULL dereference occurs in the IPv6 receive path under softirq context, meaning the panic happens during network processing rather than directly in the syscall context of the attacker — though the crash is triggered by the attacker's packet_sendmsg call.

The core weakness is CWE-476 (NULL Pointer Dereference). The patch, per the CNA title, rejects routes without an inet6_dev in ip6t_rpfilter, meaning the fix likely adds a NULL check on the route's rt6i_idev before use.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the NVD description, as no public PoC or exploit code is available.

1. Reconnaissance / target identification: The attacker needs local access to a Linux system where unprivileged user namespaces are enabled (kernel.unprivileged_userns_clone=1 or equivalent) and where ip6t_rpfilter is loaded and used in an ip6tables ruleset. The attacker checks for the presence of the module and the ip6tables configuration.

2. Triggering the flaw class: The attacker creates a private user namespace and a private network namespace using the unshare or clone system calls with the appropriate CLONE_NEWUSER and CLONE_NEWNET flags. Inside the network namespace, the attacker configures a nexthop object and an external device, then uses rtnetlink to lower the external nexthop device's MTU below IPV6_MIN_MTU (1280 bytes). This tears down the inet6_dev while leaving the route with the nexthop object in the FIB, producing a route whose rt6i_idev is NULL.

3. Payload / execution method: The attacker sends an IPv6 packet through an AF_PACKET socket (packet_sendmsg). The packet traverses the receive path, ipv6_rcv invokes nf_hook_slow, which calls ip6t_do_table and then rpfilter_mt. The rpfilter match looks up the route for the packet's source and dereferences the NULL rt6i_idev, causing a general protection fault and kernel panic. The traversal from packet_sendmsg through __dev_queue_xmit into softirq handling is visible in the provided call trace.

4. Post-exploitation impact: The direct result is a kernel panic and denial of service on the affected system. Because the vulnerability is a NULL pointer dereference triggered in softirq context, it is not a straightforward control-flow hijack; however, a NULL dereference in the kernel can, under some configurations, be leveraged via mmap of the zero page (if mmap_min_addr is 0) or via other kernel object manipulation techniques to achieve code execution. That said, the provided data does not demonstrate privilege escalation, and the primary confirmed impact is DoS. In a container environment, a successful trigger may crash the host kernel, affecting all tenants.

No public PoC is available; the attack chain described above is derived from the vulnerability class and the crash trace in the NVD description.

Impact Assessment

The vulnerability is a local denial-of-service condition. An unprivileged user with the ability to create user and network namespaces can trigger a kernel panic. On multi-tenant or containerized hosts, this can take down the entire system, causing loss of availability for all workloads.

CVSS subscores are not provided in the source data (CVSS score and vector are N/A). Based on the vulnerability class and the NVD description, a reasonable assessment would assign high availability impact, low confidentiality and integrity impact absent a demonstrated escalation path, local attack vector, low complexity, low privileges required, and no user interaction. The scope may change (S:C) because the crash affects the kernel beyond the attacker's namespace. The provided CVSS vector in the metadata is an inferred estimate; the authoritative score is not available.

Blast radius: any Linux system with IPv6 netfilter rpfilter enabled and unprivileged user namespaces allowed. This includes many container hosts, CI/CD runners, and multi-user systems. Systems with user namespaces disabled (kernel.unprivileged_userns_clone=0) are not exploitable by unprivileged users, though a privileged user could still trigger the condition.

Detection Guidance

Sigma Rule

title: Linux Kernel IPv6 rpfilter NULL Dereference (CVE-2026-98379)
id: 8a9c1f2e-3b4d-4e5f-9a7b-1c2d3e4f5a6b
status: experimental
description: Detects kernel panic or oops signatures consistent with a NULL pointer dereference in rpfilter_mt via ip6t_rpfilter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98379
author: Valters IT Threat Intelligence
logsource:
  product: linux
  service: kernel
detection:
  selection_rip:
    - 'rpfilter_mt'
    - 'ip6t_rpfilter.c'
  selection_fault:
    - 'general protection fault'
    - 'null-ptr-deref'
    - 'KASAN: null-ptr-deref'
  condition: selection_rip and selection_fault
falsepositives:
  - Legitimate kernel bugs manifesting in rpfilter
level: high

YARA Rule

rule CVE_2026_98379_Linux_rpfilter_NULL_Deref
{
    meta:
        description = "Detects kernel log or crash dumps referencing the ip6t_rpfilter NULL dereference (CVE-2026-98379)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98379"
        date = "2026-01-01"
    strings:
        $a = "rpfilter_mt" ascii wide nocase
        $b = "ip6t_rpfilter.c" ascii wide nocase
        $c = "general protection fault" ascii wide nocase
        $d = "null-ptr-deref" ascii wide nocase
        $e = "KASAN" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true) and
        (($a or $b) and ($c or $d or $e))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98379 Linux ip6t_rpfilter NULL Dereference Attempt"; flow:to_server; ip_proto:58; content:"|00|"; depth:1; metadata:created_at 2026_01_01, cve CVE_2026-98379; classtype:attempted-dos; sid:202698379; rev:1;)

Note: The vuln is local and triggered via AF_PACKET; network detection is limited. This rule is a heuristic placeholder for IPv6 traffic patterns to hosts with rpfilter enabled. No reliable network signature exists for the local trigger.

Elastic Detection

sequence by host.id with maxspan=5s
  [process where event.type == "start" and process.name in ("unshare", "clone") and process.args : "*CLONE_NEWUSER*"]
  [process where event.type == "start" and process.name == "ip" and process.args : "mtu"]

This EQL query correlates user namespace creation with MTU modification activity that could set up the vulnerable state.

Splunk SPL Query

index=linux_kernel_logs (sourcetype=syslog OR sourcetype=journald)
"rpfilter_mt" OR "ip6t_rpfilter.c" OR ("general protection fault" AND "null-ptr-deref")
| stats count min(_time) as first_seen max(_time) as last_seen by host
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table host first_seen last_seen count

Wazuh OSSEC Rule

<group name="linux,cve,cve-2026-98379,">
  <rule id="100983" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rpfilter_mt|ip6t_rpfilter.c|general protection fault</match>
    <description>CVE-2026-98379: Possible Linux kernel NULL dereference in IPv6 reverse path filter</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable unprivileged user namespaces if not required: set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (via sysctl) to block the construction of the exploit prerequisite state by unprivileged users.
   • Restrict or remove ip6t_rpfilter rules where reverse path filtering via ip6tables is not operationally necessary. Note that this removes an anti-spoofing control.
   • Restrict access to AF_PACKET sockets via seccomp or remove CAP_NET_RAW where possible.
   • Consider disabling IPv6 on hosts that do not require it.

2. Patch/upgrade steps: No patch is available from tracked sources. Monitor the Linux kernel stable and mainline repositories for a fix to net/ipv6/netfilter/ip6t_rpfilter.c that adds a NULL check on the route's rt6i_idev. When a backported kernel package becomes available from the distribution vendor, apply it promptly. Because patch confidence is 0/4, verify any claimed fix against the upstream commit that rejects routes without an inet6_dev.

3. Long-term hardening:

   • Keep the kernel updated and track vendor security advisories.
   • Enforce least privilege: remove CAP_NET_RAW and CAP_NET_ADMIN from containers and unprivileged processes.
   • Use mandatory access control (SELinux/AppArmor) profiles that restrict namespace creation and raw socket use.
   • Monitor kernel oops/panic logs for rpfilter_mt signatures and alert on repeated attempts.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98379
• Linux kernel netfilter source (mainline): net/ipv6/netfilter/ip6t_rpfilter.c
• Linux kernel commit history for ip6t_rpfilter (monitor for the fix rejecting routes without inet6_dev)
• CWE-476: NULL Pointer Dereference — https://cwe.mitre.org/data/definitions/476.html
• MITRE ATT&CK T1068: Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/

No known threat actor campaigns or exploit-in-the-wild evidence is available for CVE-2026-98379 at this time. EPSS score is not yet assigned by FIRST.org. CISA KEV status: not listed.