{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled  When booting with the 'ipv6.disable=1' parameter, inet6_addr_lst is never initialized because inet6_init() exits before addrconf_init() is called to initialize it. An attempt to bind an RDS socket to an ipv6 address results in a crash in __ipv6_chk_addr_and_flags()  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:__ipv6_chk_addr_and_flags+0x1df/0x7e0 Call Trace:  \u003cTASK\u003e  ipv6_chk_addr+0x3b/0x50  rds_tcp_laddr_check+0x155/0x3b0 [rds_tcp]  rds_trans_get_preferred+0x15d/0x2d0 [rds]  ? trace_hardirqs_on+0x2d/0x110  rds_bind+0x1433/0x1d60 [rds]  ? rds_remove_bound+0xd50/0xd50 [rds]  ? aa_af_perm+0x250/0x250  ? __might_fault+0xde/0x190  ? __sys_bind+0x1dc/0x210  __sys_bind+0x1dc/0x210  ? __ia32_sys_socketpair+0x100/0x100  ? restore_fpregs_from_fpstate+0x53/0x100  __x64_sys_bind+0x73/0xb0  ? syscall_enter_from_user_mode+0x1c/0x50  do_syscall_64+0x34/0x80  entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f47f8269ea9  \u003c/TASK\u003e  The following code reproduces the issue:  struct sockaddr_in6 addr; s = socket(PF_RDS, SOCK_SEQPACKET, 0);  memset(\u0026addr, 0, sizeof(addr)); inet_pton(AF_INET6, ADDRESS, \u0026addr.sin6_addr); addr.sin6_family = AF_INET6; addr.sin6_port = htons(PORT);  bind(s, \u0026addr, sizeof(addr));  Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.",
  "id": "DEBIAN-CVE-2026-68322",
  "modified": "2026-09-19T21:47:34.013681273Z",
  "published": "2026-08-10T13:20:22.293Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68322"
    }
  ],
  "upstream": [
    "CVE-2026-68322"
  ]
}