PT-2026-51718 · Linux · Linux
Publicado
2026-06-24
·
Atualizado
2026-06-24
·
CVE-2026-52925
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
vrf: Fix a potential NPD when removing a port from a VRF
RCU readers that identified a net device as a VRF port using
netif is l3 slave() assume that a subsequent call to
netdev master upper dev get rcu() will return a VRF device. They then
continue to dereference its l3mdev operations.
This assumption is not always correct and can result in a NPD [1]. There
is no RCU synchronization when removing a port from a VRF, so it is
possible for an RCU reader to see a new master device (e.g., a bridge)
that does not have l3mdev operations.
Fix by adding RCU synchronization after clearing the IFF L3MDEV SLAVE
flag. Skip this synchronization when a net device is removed from a VRF
as part of its deletion and when the VRF device itself is deleted. In
the latter case an RCU grace period will pass by the time RTNL is
released.
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
RIP: 0010:l3mdev fib table rcu (net/l3mdev/l3mdev.c:181)
[...]
Call Trace:
l3mdev fib table by index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189)
inet bind (net/ipv4/af inet.c:499 (discriminator 3))
inet bind sk (net/ipv4/af inet.c:469)
sys bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1))
x64 sys bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1))
do syscall 64 (arch/x86/entry/syscall 64.c:63 (discriminator 1) arch/x86/entry/syscall 64.c:94 (discriminator 1))
entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:130)
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux