{"id":"CVE-2024-40961","revision":"c30f34039b5c46d69b2d1777f259615c","records":[{"revision":"c30f34039b5c46d69b2d1777f259615c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-40961","aliases":[],"title":"ipv6: prevent possible NULL deref in fib6_nh_init()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible NULL deref in fib6_nh_init()\n\nsyzbot reminds us that in6_dev_get() can return NULL.\n\nfib6_nh_init()\n ip6_validate_gw( &idev )\n ip6_route_check_nh( idev )\n *idev = in6_dev_get(dev); // can be NULL\n\nOops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606\nCode: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b\nRSP: 0018:ffffc900032775a0 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000\nRDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8\nRBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000\nR10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8\nR13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000\nFS: 00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809\n ip6_route_add+0x28/0x160 net/ipv6/route.c:3853\n ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483\n inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579\n sock_do_ioctl+0x158/0x460 net/socket.c:1222\n sock_ioctl+0x629/0x8e0 net/socket.c:1341\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f940f07cea9","state":0,"publishedAt":"2024-07-12T12:32:02.654+00:00","modifiedAt":"2026-10-15T00:46:11.381+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv6/route.c\"\n ],\n \"versions\": [\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"de5ad4d45cd0128a2a37555f48ab69aa19d78adc\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"4cdfe813015d5a24586bd0a84fa0fa6eb0a1f668\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"88b9a55e2e35ea846d41f4efdc29d23345bd1aa4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"b6947723c9eabcab58cfb33cdb0a565a6aee6727\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"ae8d3d39efe366c2198f530e01e4bf07830bf403\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"428604fb118facce1309670779a35baf27ad044c\",\n \"lessThan\": \"2eab4543a2204092c3a7af81d7d6c506e59a03a6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv6/route.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.17\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.17\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.4.279\",\n \"lessThanOrEqual\": \"5.4.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.221\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.162\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.96\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.36\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.9.7\",\n \"lessThanOrEqual\": \"6.9.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.10\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade","https://git.kernel.org/stable/c/de5ad4d45cd0128a2a37555f48ab69aa19d78adc","https://git.kernel.org/stable/c/4cdfe813015d5a24586bd0a84fa0fa6eb0a1f668","https://git.kernel.org/stable/c/88b9a55e2e35ea846d41f4efdc29d23345bd1aa4","https://git.kernel.org/stable/c/b6947723c9eabcab58cfb33cdb0a565a6aee6727","https://git.kernel.org/stable/c/ae8d3d39efe366c2198f530e01e4bf07830bf403","https://git.kernel.org/stable/c/2eab4543a2204092c3a7af81d7d6c506e59a03a6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-40961","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-40961","identifiers":["CVE-2024-40961"]},"retained":false,"historicalAffected":[]}],"coverage":[]}