CVE-2026-64545

Received Received - Intake

NULL Pointer Dereference in Linux Kernel XDP Master Redirect

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master->flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master->flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64545

EUVD

EUVD-2026-49596

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's XDP (eXpress Data Path) subsystem. The issue occurs in the xdp_master_redirect() function, which fails to check if the master device pointer is NULL before accessing it. When a bond slave device is released, the upper-master adjacency is dropped before clearing the IFF_SLAVE flag, creating a race condition where xdp_master_redirect() may try to access a NULL master pointer, leading to a kernel panic.

Detection Guidance

This vulnerability may cause a kernel panic due to a NULL pointer dereference in xdp_master_redirect(). Detection requires checking for kernel logs indicating NULL pointer dereference errors in XDP-related functions. Monitor logs for messages like 'kernel NULL pointer dereference' or 'Fatal exception in interrupt' during XDP operations.

Impact Analysis

This vulnerability can cause a kernel panic, resulting in a complete system crash and potential data loss. It affects systems using XDP with bonded network interfaces, particularly when bond slave devices are being released or reconfigured. The crash occurs during network packet processing, potentially disrupting network services and causing downtime.

Compliance Impact

This vulnerability is a kernel NULL pointer dereference in the Linux network stack, causing kernel panics. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance impact would be indirect if system crashes lead to service unavailability or data corruption.

Mitigation Strategies

Apply the Linux kernel patch that adds a NULL check for the master device in xdp_master_redirect(). Update to a kernel version containing the fix from commit 1921f91298d1 or later. If immediate patching is not possible, avoid using XDP_TX on bond slave devices until patched.

Hi! I’m here to help you understand CVE-2026-64545. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70