Unknown

CVE-2026-72392 — ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump inet6_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6_new_table() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6_dump_table() to set w->root to the wrong table while w->node still points into the previous one. fib6_walk_continue() dereferences w->node->parent (NULL) and panics: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6_walk_continue+0x6e/0x170 Call Trace: <TASK> fib6_dump_table.isra.0+0xc5/0x240 inet6_dump_fib+0xf6/0x420 rtnl_dumpit+0x30/0xa0 netlink_dump+0x15b/0x460 netlink_recvmsg+0x1d6/0x2a0 ____sys_recvmsg+0x17a/0x190 Fix by storing tb->tb6_id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.

Published Aug 15, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+2

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.22%

ahead of 12% of scored CVEs · Oct 29, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < ee73a32dd258d4af66831ff006b771e19812b322≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < 89f9c5fee3c64c5cabc34e65599308fd3c879cf9≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < cb90a774a9c6c46961a44949a246fbb61f5f934c≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < 27210d433a8c5fe6bf7278a04bbaeb49a81d0290≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < 059efb48dd746518898faaa9b965511009b59639≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < d8a01d27873e04bebd357dc87859aa756e0b28b2≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < 110ccbd28c9444866fcc84ba96a2ad64fa6e95ae≥ 1b43af5480c351dbcb2eef478bafe179cbeb6e83 and < 9facb861dc6b9b9ea9793ef5032a9a826f7a4229 and 1 more version 2.6.19	Vulnerable	CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 29, 2026 · 14 reading(s) · max 0.22%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Aug 15, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/27210d433a8c5fe6bf7278a04bbaeb49a81d0290
NIST National Vulnerability Database
git.kernel.org/stable/c/89f9c5fee3c64c5cabc34e65599308fd3c879cf9
NIST National Vulnerability Database
git.kernel.org/stable/c/cb90a774a9c6c46961a44949a246fbb61f5f934c
NIST National Vulnerability Database
git.kernel.org/stable/c/110ccbd28c9444866fcc84ba96a2ad64fa6e95ae
NIST National Vulnerability Database
git.kernel.org/stable/c/059efb48dd746518898faaa9b965511009b59639
NIST National Vulnerability Database
git.kernel.org/stable/c/ee73a32dd258d4af66831ff006b771e19812b322
NIST National Vulnerability Database
git.kernel.org/stable/c/d8a01d27873e04bebd357dc87859aa756e0b28b2
NIST National Vulnerability Database
git.kernel.org/stable/c/9facb861dc6b9b9ea9793ef5032a9a826f7a4229
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 2d
Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 2d
Unknown CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock 2d
Unknown CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation 2d
Unknown CVE-2026-99209 drm/xe: skip eviction of a BO with no resource 2d
Unknown CVE-2026-99210 accel/rocket: clear rdev on device init failure 2d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-72392 is "ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.22% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.