In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80646 is a NULL pointer dereference vulnerability in the Linux kernel's IPv6 statistics gathering function __in6_dev_stats_get(). The issue arises when dev_get_by_index_rcu() returns NULL after a physical device is unregistered, but the subsequent code attempts to dereference this NULL pointer without proper validation. This affects Linux systems running vulnerable kernel versions, particularly those handling IPv6 network traffic or monitoring. While not currently exploited in the wild according to CISA, the vulnerability could lead to kernel crashes (denial of service) if triggered, impacting system availability and potentially affecting services that depend on stable network device state.
Although this CVE currently has no mapped MITRE ATT&CK techniques or associated Casky skills, practitioners using Casky.ai's extended reasoning capabilities with Claude would benefit from monitoring for attack patterns related to resource exhaustion and denial of service mechanisms. Security teams should focus on detection patterns around abnormal network device registration/unregistration cycles, kernel panic logs, and IPv6 statistics query anomalies. The vulnerability underscores the importance of implementing defensive coding practices such as NULL pointer checks after RCU-protected lookups—a pattern Casky's skill framework helps practitioners identify across similar kernel subsystems. Organizations should prioritize patching this issue on Linux systems handling critical IPv6 traffic to maintain system stability and prevent potential DoS conditions.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80646. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation