PT-2026-65220 · Linux · Linux
CVE-2026-64545
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: check master for NULL in xdp master redirect()
xdp master redirect() dereferences the result of
netdev master upper dev get rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.
The reach guard only checks netif is bond slave(). On bond slave release
bond upper dev unlink() drops the upper-master adjacency before clearing
IFF SLAVE, so an XDP TX reaching xdp master redirect() in that window
still passes netif is bond slave() while master is already NULL, and
faults on master->flags at offset 0xb0:
BUG: kernel NULL pointer dereference, address: 00000000000000b0
RIP: 0010:xdp master redirect (net/core/filter.c:4432)
Call Trace:
xdp master redirect (net/core/filter.c:4432)
bpf prog run generic xdp (include/net/xdp.h:700)
do xdp generic (net/core/dev.c:5608)
netif receive skb one core (net/core/dev.c:6204)
process backlog (net/core/dev.c:6319)
napi poll (net/core/dev.c:7729)
net rx action (net/core/dev.c:7792)
handle softirqs (kernel/softirq.c:622)
dev queue xmit (include/linux/bottom half.h:33)
packet sendmsg (net/packet/af packet.c:3082)
sys sendto (net/socket.c:2252)
Kernel panic - not syncing: Fatal exception in interrupt
The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp master redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux