{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.170-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled  When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags().   BUG: kernel NULL pointer dereference, address: 00000000000005d8  Oops: Oops: 0000 [#1] SMP NOPTI  RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170  Call Trace:   \u003cIRQ\u003e   ipv6_chk_addr+0x1f/0x30   bond_validate_na+0x12e/0x1d0 [bonding]   ? __pfx_bond_handle_frame+0x10/0x10 [bonding]   bond_rcv_validate+0x1a0/0x450 [bonding]   bond_handle_frame+0x5e/0x290 [bonding]   ? srso_alias_return_thunk+0x5/0xfbef5   __netif_receive_skb_core.constprop.0+0x3e8/0xe50   ? srso_alias_return_thunk+0x5/0xfbef5   ? update_cfs_rq_load_avg+0x1a/0x240   ? srso_alias_return_thunk+0x5/0xfbef5   ? __enqueue_entity+0x5e/0x240   __netif_receive_skb_one_core+0x39/0xa0   process_backlog+0x9c/0x150   __napi_poll+0x30/0x200   ? srso_alias_return_thunk+0x5/0xfbef5   net_rx_action+0x338/0x3b0   handle_softirqs+0xc9/0x2a0   do_softirq+0x42/0x60   \u003c/IRQ\u003e   \u003cTASK\u003e   __local_bh_enable_ip+0x62/0x70   __dev_queue_xmit+0x2d3/0x1000   ? srso_alias_return_thunk+0x5/0xfbef5   ? srso_alias_return_thunk+0x5/0xfbef5   ? packet_parse_headers+0x10a/0x1a0   packet_sendmsg+0x10da/0x1700   ? kick_pool+0x5f/0x140   ? srso_alias_return_thunk+0x5/0xfbef5   ? __queue_work+0x12d/0x4f0   __sys_sendto+0x1f3/0x220   __x64_sys_sendto+0x24/0x30   do_syscall_64+0x101/0xf80   ? exc_page_fault+0x6e/0x170   ? srso_alias_return_thunk+0x5/0xfbef5   entry_SYSCALL_64_after_hwframe+0x77/0x7f   \u003c/TASK\u003e  Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().",
  "id": "DEBIAN-CVE-2026-43441",
  "modified": "2026-09-14T16:47:28.212437550Z",
  "published": "2026-05-08T15:16:56.523Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43441"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43441"
  ]
}