Commit 168ff39e4758 for kernel

commit 168ff39e4758897d2eee4756977d036d52884c7e
Author: Fernando Fernandez Mancera <fmancera@suse.de>
Date:   Wed Mar 4 13:03:57 2026 +0100

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

    When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
    initialized because inet6_init() exits before ndisc_init() is called
    which initializes it. If an IPv6 packet is injected into the interface,
    route_shortcircuit() is called and a NULL pointer dereference happens on
    neigh_lookup().

     BUG: kernel NULL pointer dereference, address: 0000000000000380
     Oops: Oops: 0000 [#1] SMP NOPTI
     [...]
     RIP: 0010:neigh_lookup+0x20/0x270
     [...]
     Call Trace:
      <TASK>
      vxlan_xmit+0x638/0x1ef0 [vxlan]
      dev_hard_start_xmit+0x9e/0x2e0
      __dev_queue_xmit+0xbee/0x14e0
      packet_sendmsg+0x116f/0x1930
      __sys_sendto+0x1f5/0x200
      __x64_sys_sendto+0x24/0x30
      do_syscall_64+0x12f/0x1590
      entry_SYSCALL_64_after_hwframe+0x76/0x7e

    Fix this by adding an early check on route_shortcircuit() when protocol
    is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because
    VXLAN can be built-in even when IPv6 is built as a module.

    Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support")
    Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
    Link: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 05558b6afecd..17c941aac32d 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2130,6 +2130,11 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
 	{
 		struct ipv6hdr *pip6;

+		/* check if nd_tbl is not initiliazed due to
+		 * ipv6.disable=1 set during boot
+		 */
+		if (!ipv6_stub->nd_tbl)
+			return false;
 		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 			return false;
 		pip6 = ipv6_hdr(skb);