PT-2026-65220 · Linux · Linux
CVE-2026-64545
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: check master for NULL in xdp master redirect()
xdp master redirect() dereferences the result of
netdev master upper dev get rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.
The reach guard only checks netif is bond slave(). On bond slave release
bond upper dev unlink() drops the upper-master adjacency before clearing
IFF SLAVE, so an XDP TX reaching xdp master redirect() in that window
still passes netif is bond slave() while master is already NULL, and
faults on master->flags at offset 0xb0:
BUG: kernel NULL pointer dereference, address: 00000000000000b0
RIP: 0010:xdp master redirect (net/core/filter.c:4432)
Call Trace:
xdp master redirect (net/core/filter.c:4432)
bpf prog run generic xdp (include/net/xdp.h:700)
do xdp generic (net/core/dev.c:5608)
netif receive skb one core (net/core/dev.c:6204)
process backlog (net/core/dev.c:6319)
napi poll (net/core/dev.c:7729)
net rx action (net/core/dev.c:7792)
handle softirqs (kernel/softirq.c:622)
dev queue xmit (include/linux/bottom half.h:33)
packet sendmsg (net/packet/af packet.c:3082)
sys sendto (net/socket.c:2252)
Kernel panic - not syncing: Fatal exception in interrupt
The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp master redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux