---
id: CVE-2026-43101
title: 'ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

  We need to check __in6_dev_get() for possible NULL value, as
  suggested by Yiming Qian.

  Also a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    34b8390ac0ba57004b90ea568ac06f50bf896a80
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    f87aa5d1a7f56727a768757613a303b4245444a1
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    4198aab6f000b4febb18ea820fea20634dd789c7
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    3719c234fa94c37c955b1ecd3742ef280ec135e6
  - >-
    Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 <
    4e65a8b8daa18d63255ec58964dd192c7fdd9f8b
  - Linux 5.15
published: '2026-05-06'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:40:03.216Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43101'
references:
  - url: 'https://git.kernel.org/stable/c/34b8390ac0ba57004b90ea568ac06f50bf896a80'
  - url: 'https://git.kernel.org/stable/c/f87aa5d1a7f56727a768757613a303b4245444a1'
  - url: 'https://git.kernel.org/stable/c/4198aab6f000b4febb18ea820fea20634dd789c7'
  - url: 'https://git.kernel.org/stable/c/3719c234fa94c37c955b1ecd3742ef280ec135e6'
  - url: 'https://git.kernel.org/stable/c/4e65a8b8daa18d63255ec58964dd192c7fdd9f8b'
tags:
  - cve.org
epss: 0.00609
epssPercentile: 0.48205
ingestedAt: '2026-10-21T12:48:53.648Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

We need to check __in6_dev_get() for possible NULL value, as
suggested by Yiming Qian.

Also add skb_dst_dev_rcu() instead of skb_dst_dev(),
and two missing READ_ONCE().

Note that @dev can't be NULL.

## Affected

- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 34b8390ac0ba57004b90ea568ac06f50bf896a80`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < f87aa5d1a7f56727a768757613a303b4245444a1`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 4198aab6f000b4febb18ea820fea20634dd789c7`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 3719c234fa94c37c955b1ecd3742ef280ec135e6`
- `Linux >= 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 < 4e65a8b8daa18d63255ec58964dd192c7fdd9f8b`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.