Linux Kernel Neighbour Module Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's neighbour management module. This issue arises in the 'neigh_flush_dev()' function, which was modified to use a per-network-device neighbour list instead of a global hash table. The vulnerability occurs because 'neigh_table_clear()' can call 'neigh_ifdown()' with a NULL device pointer, leading to a general protection fault. This issue has been observed in Linux kernel version 6.12.0-rc6.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a general protection fault and a crash of the kernel process.

Reproduction

The vulnerability can be reproduced by loading the IPv6 module, which is no longer unloadable. When the module attempts to unregister permanent protocols, 'neigh_table_clear()' is called, potentially with a NULL device pointer, causing the null pointer dereference.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.