CVE-2026-80646

CVE-2026-80646 is a NULL pointer dereference flaw in the Linux kernel's IPv6 networking code, specifically in __in6_dev_stats_get(), which fetches per-interface IPv6 statistics. It is triggered when the original physical network device has been unregistered: in that case dev_get_by_index_rcu() can return NULL, and the code dereferences the result without a guard, crashing the kernel. Because the CVSS vector scores availability impact only (A:H, no confidentiality or integrity impact), an attacker's gain is denial of service, i.e., a kernel oops or panic on the affected host. Any system running a Linux kernel with this IPv6 code path — including servers, cloud instances, and embedded or appliance-style devices that use IPv6 — is potentially affected, though the affected version range is not stated in the available data. Exploitation status is benign so far: there is no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.5% probability of exploitation in the next 30 days.

What to do: There are no fixed version numbers in the advisory data, so track your kernel vendor's (or LTS distribution's) security feed and apply the upstream kernel patch containing the __in6_dev_stats_get() NULL guard as soon as it ships in a stable release you can adopt. Until then, inventory hosts running kernels with IPv6 enabled and watch logs for kernel oopses or panics referencing __in6_dev_stats_get() or interface teardown races, since those indicate the bug is being hit.