🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-64569 is a NULL pointer dereference vulnerability in the Linux kernel’s MPLS (Multiprotocol Label Switching) subsystem, specifically in the mpls_valid_fib_dump_req() function when the kernel is compiled without IPv4 support (CONFIG_INET=n). This type of bug can cause a kernel crash, leading to a denial of service on affected systems. Azure workloads running Linux-based virtual machines or containerised environments on affected kernel versions may be exposed.
Security Architect’s Take: Review the Linux kernel versions running across your Azure Linux VMs and AKS node pools, and prioritise patching to a version that includes this fix — particularly for any hardened or custom kernel builds where CONFIG_INET=n is plausible. Monitor Microsoft’s update guidance for Azure-specific affected SKUs and apply OS updates via your standard patching pipeline.
Original advisory: CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n