Microsoft’s entry supplies the CVE identifier and the terse title, “mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n,” but it does not identify an affected Microsoft product, a severity rating, a CVSS vector, an update, a mitigation, or even a kernel-version range. That omission matters here because the technical record in the Linux networking tree shows a tightly constrained bug whose relevance cannot be inferred from a generic Microsoft advisory page.
There is also a timing problem in the submitted metadata. It labels the item as published at 1:43 a.m. Pacific Daylight Time on August 9, 2026 — 08:43 UTC — which is 86 minutes after the 07:17 UTC review time. The advisory may be in the process of publication, but its stated timestamp should not be read as proof that an accompanying Windows security release exists.
The crash sits in a configuration-specific MPLS fallback
The Linux networking tree records the correction as commit
56d96fededd61192cd7cc8d2b0f36adfd59036c3, merged by network maintainer Paolo Abeni on July 17, 2026. It fixes
mpls_valid_fib_dump_req(), the routine that validates strict netlink requests to dump MPLS forwarding information.
The defect is simple but consequential. When Linux is compiled with
CONFIG_INET=n, the MPLS implementation cannot delegate this validation to the normal IPv4 helper,
ip_valid_fib_dump_req(). Instead, it uses its own fallback parser and iterates through a table of netlink attributes.
For the output-interface attribute,
RTA_OIF, that fallback code called
nla_get_u32(tb*)even when the parsed attribute pointer was absent. A route-dump request for the
AF_MPLSaddress family, made with strict validation enabled but without
RTA_OIF, could therefore make the kernel dereference a null pointer.
The upstream commit includes a Kernel AddressSanitizer trace showing the fault in
mpls_valid_fib_dump_req(), reached through
mpls_dump_routes(), netlink dump handling, and
rtnetlink_rcv_msg(). This is a crash condition: it can take down the affected kernel rather than expose memory or execute attacker-controlled code.
The repair adds a three-line guard that skips attributes not supplied in the request. That makes the MPLS-only fallback match the safer behavior already used by the IPv4-backed implementation.
An unprivileged local user can trigger the vulnerable request
The upstream commit makes an important point absent from the Microsoft entry: the relevant
RTM_GETROUTEoperation is permitted without
CAP_NET_ADMIN. In the vulnerable configuration, a local unprivileged process can submit the malformed-but-parseable route-dump request and trigger the null dereference.
That makes CVE-2026-64569 more than an administrator-only configuration bug. On a qualifying device, it is a local availability issue that could let an ordinary account crash the kernel. In multi-user or container-heavy deployments, a kernel panic is an outage regardless of whether the attacker can read protected data or elevate privileges.
The preconditions are unusually narrow, however:
- The kernel must include MPLS support through
CONFIG_MPLS. - The kernel must be compiled with
CONFIG_INET=n, excluding normal IPv4 networking support. - The requester must reach the strict-checking MPLS route-dump validation path without including the output-interface attribute.
Linux’s own Kconfig description says MPLS is disabled by default and advises users unfamiliar with it to leave it disabled. Separately,
CONFIG_INETis the kernel’s TCP/IP networking option and is ordinarily enabled on general-purpose Linux distributions. The affected combination is therefore plausible for specialized networking appliances, embedded images, lab builds, and stripped-down custom kernels, but it is a poor match for a conventional server, desktop, or cloud guest.
The vulnerable code dates to Linux 4.20-era work
The fix identifies the introducing change as commit
196cfebf8972, “net/mpls: Handle kernel side filtering of route dumps.” Linux development history places that commit on October 16, 2018, before Linux 4.20 shipped on December 23, 2018.
That means this is not a short-lived regression in a newly released kernel. The unsafe fallback has existed in the relevant source line for nearly eight years, while being effectively masked on the much more common
CONFIG_INET=ybuilds. The configuration split is why the flaw escaped the earlier review of a related March 2026 patch.
That earlier patch, posted to the Linux kernel mailing lists by Yiqi Sun, identified the missing null check and initially proposed rejecting the request with
-EINVAL. Paolo Abeni suggested a cleaner reordering: ignore absent attributes first, then process the output-interface selector only when it exists, while continuing to reject attributes that are present but unsupported. The final July fix follows that design.
This sequence changes how administrators should interpret the CVE. The flaw was visible to code review in March, but the final commit is not merely a defensive null check stapled onto an input parser. It preserves the intended route-dump semantics: no interface filter means no interface filter, while an invalid supplied attribute remains an error.
Why the Microsoft listing should not trigger Windows patching
Microsoft’s Security Update Guide is authoritative for Microsoft’s own advisories, but the supplied entry presently does not connect this CVE to Windows, Windows Server, Azure, Hyper-V, WSL, or a Microsoft-maintained Linux kernel package. It also provides no affected build numbers and no security-update table. Treating its presence there as evidence of a Windows kernel bug would be a category error.
Windows does not execute this Linux MPLS code in its own kernel. WSL 2 uses a Linux kernel inside its utility VM, but the trigger requires a deliberately nonstandard kernel build with
CONFIG_INET=n; ordinary WSL 2 networking depends on IP networking being available. The record therefore does not establish that stock WSL installations are affected.
Custom WSL kernel users should still verify their own
.configrather than rely on that general conclusion. If a bespoke WSL 2 kernel has both MPLS enabled and
CONFIG_INETdisabled, it deserves the same review as any other specialized Linux image. The Microsoft entry offers no version mapping that would let administrators determine that from the Windows host build alone.
At the time of review, the National Vulnerability Database did not return an indexed public entry for CVE-2026-64569, and CVE.org did not surface a usable public record. No independent outlet appears to have published a separate assessment of affected distribution packages or stable-kernel backports. That leaves the upstream Linux commit as the primary technical record and makes vendor package tracking more important than a generic CVE dashboard status.
What Linux and Windows administrators should do now
Linux appliance and embedded-device maintainers should inspect the running or build-time kernel configuration for
CONFIG_MPLSand
CONFIG_INET. Systems with
CONFIG_INET=ydo not compile the vulnerable fallback routine; systems without MPLS support do not expose this MPLS route-dump code at all.
For the narrow group that has both MPLS enabled and IPv4 support disabled, the appropriate remediation is to consume a kernel release or vendor backport containing upstream commit
56d96fededd61192cd7cc8d2b0f36adfd59036c3. If an immediate kernel replacement is not feasible, restricting untrusted local code is the practical exposure reduction, because the upstream record says the request does not require
CAP_NET_ADMIN.
Windows administrators should not hunt for a KB or force a Windows Update deployment for CVE-2026-64569. The concrete outstanding task is for Microsoft, the CVE record, or Linux distributors to publish an affected-version and fixed-version map; until that exists, the only defensible triage is configuration-based, and most Windows and standard WSL systems fall outside the demonstrated trigger path.
References
- Primary source: MSRC
Published: August 9, 2026 at 8:43 AM UTC
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
- Related coverage: gbmc.googlesource.com
- Related coverage: msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
- Related coverage: cve.org
- Related coverage: nvd.nist.gov
Vulnerability APIs
nvd.nist.gov
- Related coverage: nvd.nist.gov
- Related coverage: cve.org
- Related coverage: linux.googlesource.com
- Related coverage: coral.googlesource.com
- Related coverage: git.zx2c4.com
- Related coverage: android.googlesource.com
- Related coverage: git.evolution-x.org
- Related coverage: git.zx2c4.com
*
