{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: ndisc: fix NULL deref in accept_untracked_na()  accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev-\u003ecnf.accept_untracked_na without a NULL check, even though its only caller ndisc_recv_na() already fetched and NULL-checked idev for the same device.  Both reads of dev-\u003eip6_ptr run in the same RCU read-side critical section, but a concurrent addrconf_ifdown() can clear dev-\u003eip6_ptr between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchronize_net() that orders the unregister path, so the re-fetch returns NULL and oopses:   BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)  Read of size 4 at addr 0000000000000364  Call Trace:   \u003cIRQ\u003e   ndisc_recv_na (net/ipv6/ndisc.c:974)   icmpv6_rcv (net/ipv6/icmp.c:1193)   ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)   ip6_input_finish (net/ipv6/ip6_input.c:534)   ip6_input (net/ipv6/ip6_input.c:545)   ip6_mc_input (net/ipv6/ip6_input.c:635)   ipv6_rcv (net/ipv6/ip6_input.c:351)   \u003c/IRQ\u003e  It is reachable by an unprivileged user via a network namespace.  Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev-\u003eip6_ptr has been cleared.",
  "id": "DEBIAN-CVE-2026-64542",
  "modified": "2026-09-14T16:47:30.443797903Z",
  "published": "2026-07-27T21:17:06.730Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64542"
    }
  ],
  "upstream": [
    "CVE-2026-64542"
  ]
}