{"apiVersion":"1.0","identifier":"CVE-2026-72392","description":"In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump inet6_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6_new_table() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6_dump_table() to set w->root to the wrong table while w->node still points into the previous one. fib6_walk_continue() dereferences w->node->parent (NULL) and panics: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6_walk_continue+0x6e/0x170 Call Trace: <TASK> fib6_dump_table.isra.0+0xc5/0x240 inet6_dump_fib+0xf6/0x420 rtnl_dumpit+0x30/0xa0 netlink_dump+0x15b/0x460 netlink_recvmsg+0x1d6/0x2a0 ____sys_recvmsg+0x17a/0x190 Fix by storing tb->tb6_id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.","publishedAt":"2026-08-15T06:22:12","lastModifiedAt":"2026-08-19T17:21:00","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72392","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00216,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72392","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72392","en":"https://www.redsauce.net/en/cves/CVE-2026-72392","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72392","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72392","de":"https://www.redsauce.net/de/cves/CVE-2026-72392","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72392","el":"https://www.redsauce.net/el/cves/CVE-2026-72392"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72392"}}