CVE-2008-3686: Linux Kernel

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

The rt6_fill_node function in net/ipv6/route.c in Linux kernel 2.6.26-rc4, 2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a denial of service (kernel OOPS) via IPv6 requests when no IPv6 input device is in use, which triggers a NULL pointer dereference.

Affected products

• Linux Linux Kernel: version 2.6.26 only; version 2.6.26.2 only

Published 2008-08-14. Last modified 2026-06-16.