---
id: CVE-2026-64569
title: 'mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

  On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed
  attribute table itself instead o…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    bfc1cb5d6a8308e493e307f1c823d2107abc0a47
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    03b5a2c29afc8e634924c75d6ee94140e70de88d
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    e796ce9ef4356dc7cbbaa8373843f77852f2814d
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    d6eee7cd078aaf9dd75efc801f6c9b608a37cd71
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    5f6e7b32bd1fbde10fd31a4143260735ea535b8a
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    06db79411a280707c7e4bf4b221ff4e664b51502
  - >-
    Linux >= 196cfebf897266c3450519e916bab9daff74e52c <
    56d96fededd61192cd7cc8d2b0f36adfd59036c3
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:41:31.330499Z'
published: '2026-08-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:57.360Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64569'
references:
  - url: 'https://git.kernel.org/stable/c/bfc1cb5d6a8308e493e307f1c823d2107abc0a47'
  - url: 'https://git.kernel.org/stable/c/03b5a2c29afc8e634924c75d6ee94140e70de88d'
  - url: 'https://git.kernel.org/stable/c/e796ce9ef4356dc7cbbaa8373843f77852f2814d'
  - url: 'https://git.kernel.org/stable/c/d6eee7cd078aaf9dd75efc801f6c9b608a37cd71'
  - url: 'https://git.kernel.org/stable/c/ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce'
  - url: 'https://git.kernel.org/stable/c/5f6e7b32bd1fbde10fd31a4143260735ea535b8a'
  - url: 'https://git.kernel.org/stable/c/06db79411a280707c7e4bf4b221ff4e664b51502'
  - url: 'https://git.kernel.org/stable/c/56d96fededd61192cd7cc8d2b0f36adfd59036c3'
tags:
  - cve.org
epss: 0.00171
epssPercentile: 0.06492
ingestedAt: '2026-11-06T16:57:43.152Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed
attribute table itself instead of calling ip_valid_fib_dump_req(). The
RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is
present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no
RTA_OIF hits a NULL dereference.

RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without
CAP_NET_ADMIN, so an unprivileged user can trigger it.

  Oops: general protection fault, probably for non-canonical address
        0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
  Call Trace:
   mpls_dump_routes (net/mpls/af_mpls.c:2236)
   netlink_dump (net/netlink/af_netlink.c:2331)
   __netlink_dump_start (net/netlink/af_netlink.c:2446)
   rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)
   netlink_rcv_skb (net/netlink/af_netlink.c:2556)
   netlink_unicast (net/netlink/af_netlink.c:1345)
   netlink_sendmsg (net/netlink/af_netlink.c:1900)
   __sock_sendmsg (net/socket.c:790)
   ____sys_sendmsg (net/socket.c:2684)
   ___sys_sendmsg (net/socket.c:2738)
   __sys_sendmsg (net/socket.c:2770)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Skip unset attributes, as ip_valid_fib_dump_req() does.

## Affected

- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < bfc1cb5d6a8308e493e307f1c823d2107abc0a47`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < 03b5a2c29afc8e634924c75d6ee94140e70de88d`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < e796ce9ef4356dc7cbbaa8373843f77852f2814d`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < d6eee7cd078aaf9dd75efc801f6c9b608a37cd71`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < ad6284ced6a15e4abd57ca4d0793b7bd15ca52ce`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < 5f6e7b32bd1fbde10fd31a4143260735ea535b8a`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < 06db79411a280707c7e4bf4b221ff4e664b51502`
- `Linux >= 196cfebf897266c3450519e916bab9daff74e52c < 56d96fededd61192cd7cc8d2b0f36adfd59036c3`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.