CVE-2026-23293

In the Linux kernel, the following vulnerability has been resolved:

net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the ndtbl is never initialized because inet6init() exits before ndiscinit() is called which initializes it. If an IPv6 packet is injected into the interface, routeshortcircuit() is called and a NULL pointer dereference happens on neigh_lookup().

BUG: kernel NULL pointer dereference, address: 0000000000000380 Oops: Oops: 0000 [#1] SMP NOPTI [...] RIP: 0010:neighlookup+0x20/0x270 [...] Call Trace: <TASK> vxlanxmit+0x638/0x1ef0 [vxlan] devhardstart_xmit+0x9e/0x2e0 __devqueuexmit+0xbee/0x14e0 packet_sendmsg+0x116f/0x1930 __sys_sendto+0x1f5/0x200 __x64syssendto+0x24/0x30 dosyscall64+0x12f/0x1590 entrySYSCALL64afterhwframe+0x76/0x7e

Fix this by adding an early check on routeshortcircuit() when protocol is ETHPIPV6. Note that ipv6mod_enabled() cannot be used here because VXLAN can be built-in even when IPv6 is built as a module.