{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump  inet6_dump_fib() saves its progress in cb-\u003eargs[1] as a positional index within the current hash chain.  Between batches, a concurrent fib6_new_table() can insert a new table at the chain head, shifting all existing entries.  The saved index then lands on a different table, causing fib6_dump_table() to set w-\u003eroot to the wrong table while w-\u003enode still points into the previous one. fib6_walk_continue() dereferences w-\u003enode-\u003eparent (NULL) and panics:    BUG: kernel NULL pointer dereference, address: 0000000000000008   RIP: 0010:fib6_walk_continue+0x6e/0x170   Call Trace:    \u003cTASK\u003e    fib6_dump_table.isra.0+0xc5/0x240    inet6_dump_fib+0xf6/0x420    rtnl_dumpit+0x30/0xa0    netlink_dump+0x15b/0x460    netlink_recvmsg+0x1d6/0x2a0    ____sys_recvmsg+0x17a/0x190  Fix by storing tb-\u003etb6_id in cb-\u003eargs[1] instead of a positional index.  On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.",
  "id": "DEBIAN-CVE-2026-72392",
  "modified": "2026-09-14T16:47:34.457554622Z",
  "published": "2026-08-15T06:22:12.733Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72392"
    }
  ],
  "upstream": [
    "CVE-2026-72392"
  ]
}