Description
The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-164.15.1.el5 | RHSA-2010:0147 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.3 EUS | kernel +11 | 2.6.18-128.14.1.el5 | RHSA-2010:0149 |
| RHEL 5.2 EUS | kernel +11 | 2.6.18-92.1.38.el5 | RHSA-2010:0148 |
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-149.el5rt | RHSA-2010:0161 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linux Kernel 2.6.x - 'net/ipv6/ip6_output.c' Null Pointer Dereference Denial of Service EDB-33635 · dos · Jul 31, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2010:0148 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0149 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0147 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0161 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2010:0147 vendor-advisory
- http://bugzilla.kernel.org/show_bug.cgi?id=11469
- oval:org.mitre.oval:def:10061 vdb-entry signature
- [oss-security] 20100211 CVE request - kernel: ip6_dst_lookup_tail() NULL pointer dereference mailing-list
- 43315 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=563781
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27
- 39033 third-party-advisory
- [oss-security] 20100304 Re: CVE request - kernel: ip6_dst_lookup_tail() NULL pointer dereference mailing-list
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- RHSA-2010:0161 vendor-advisory