From: Maximilian Pezzullo via B4 Relay <[email protected]> Date: Wed, 04 Mar 2026 09:20:23 +0100 > From: Maximilian Pezzullo <[email protected]> > > When the kernel is booted with ipv6.disable=1, the IPv6 module loads > but skips full initialization, leaving ipv6_stub as NULL. If the bridge > neigh_suppress feature is enabled on a port and an ICMPv6 Neighbor > Solicitation arrives, br_do_suppress_nd() calls neigh_lookup() via > ipv6_stub->nd_tbl without first checking whether ipv6_stub is valid, > causing a kernel panic. > > Fix this by returning early if ipv6_stub or its nd_tbl pointer is NULL. > > Reported-by: Guruprasad C P <[email protected]> > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221143 > Signed-off-by: Maximilian Pezzullo <[email protected]> > --- > net/bridge/br_arp_nd_proxy.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c > index 1e2b51769eec..0b1b9ba29b7d 100644 > --- a/net/bridge/br_arp_nd_proxy.c > +++ b/net/bridge/br_arp_nd_proxy.c > @@ -455,6 +455,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct > net_bridge *br, > return; > } > > + if (!ipv6_stub || !ipv6_stub->nd_tbl) > + return;
ipv6_stub is never be NULL. Also, Fernando is already working on the fix. https://lore.kernel.org/netdev/[email protected]/ https://lore.kernel.org/netdev/[email protected]/ > + > n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev); > if (n) { > struct net_bridge_fdb_entry *f; > > --- > base-commit: af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08 > change-id: 20260304-br-nd-suppress-ipv6-null-fix-0a516fc27f1a > > Best regards, > -- > Maximilian Pezzullo <[email protected]>
