---
id: CVE-2026-43099
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

  ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the
  IPv6 stack is not active (CONFIG_IPV6=m and …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

  ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the
  IPv6 stack is not active (CONFIG_IPV6=m and …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.13, < 6.6.136'
  - 'linux_kernel >= 6.7, < 6.12.83'
  - 'linux_kernel >= 6.13, < 6.18.24'
  - 'linux_kernel >= 6.19, < 6.19.14'
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.14
published: '2026-05-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:30.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43099'
references:
  - url: 'https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.007
epssPercentile: 0.52088
ingestedAt: '2026-10-15T03:30:12.872Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the
IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing
this error pointer to dev_hold() will cause a kernel crash with
null-ptr-deref.

Instead, silently discard the request. RFC 8335 does not appear to
define a specific response for the case where an IPv6 interface
identifier is syntactically valid but the implementation cannot perform
the lookup at runtime, and silently dropping the request may safer than
misreporting "No Such Interface".

## Affected

- `linux_kernel >= 5.13, < 6.6.136`
- `linux_kernel >= 6.7, < 6.12.83`
- `linux_kernel >= 6.13, < 6.18.24`
- `linux_kernel >= 6.19, < 6.19.14`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.14`