Re: [PATCH] net: bridge: fix NULL dereference in br_do_suppress_nd when ipv6.disable=1

From: Maximilian Pezzullo via B4 Relay <[email protected]>
Date: Wed, 04 Mar 2026 09:20:23 +0100
> From: Maximilian Pezzullo <[email protected]>
> 
> When the kernel is booted with ipv6.disable=1, the IPv6 module loads
> but skips full initialization, leaving ipv6_stub as NULL. If the bridge
> neigh_suppress feature is enabled on a port and an ICMPv6 Neighbor
> Solicitation arrives, br_do_suppress_nd() calls neigh_lookup() via
> ipv6_stub->nd_tbl without first checking whether ipv6_stub is valid,
> causing a kernel panic.
> 
> Fix this by returning early if ipv6_stub or its nd_tbl pointer is NULL.
> 
> Reported-by: Guruprasad C P <[email protected]>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221143
> Signed-off-by: Maximilian Pezzullo <[email protected]>
> ---
>  net/bridge/br_arp_nd_proxy.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
> index 1e2b51769eec..0b1b9ba29b7d 100644
> --- a/net/bridge/br_arp_nd_proxy.c
> +++ b/net/bridge/br_arp_nd_proxy.c
> @@ -455,6 +455,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
>  		return;
>  	}
>  
> +	if (!ipv6_stub || !ipv6_stub->nd_tbl)
> +		return;

ipv6_stub is never be NULL.

Also, Fernando is already working on the fix.
https://lore.kernel.org/netdev/[email protected]/
https://lore.kernel.org/netdev/[email protected]/


> +
>  	n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev);
>  	if (n) {
>  		struct net_bridge_fdb_entry *f;
> 
> ---
> base-commit: af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08
> change-id: 20260304-br-nd-suppress-ipv6-null-fix-0a516fc27f1a
> 
> Best regards,
> -- 
> Maximilian Pezzullo <[email protected]>