CVE-2026-64545 - Vulnerability Details

- net, bpf: check master for NULL in xdp_master_redirect()

Description

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: check master for NULL in xdp_master_redirect()

xdp_master_redirect() dereferences the result of
netdev_master_upper_dev_get_rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.

The reach guard only checks netif_is_bond_slave(). On bond slave release
bond_upper_dev_unlink() drops the upper-master adjacency before clearing
IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window
still passes netif_is_bond_slave() while master is already NULL, and
faults on master->flags at offset 0xb0:

BUG: kernel NULL pointer dereference, address: 00000000000000b0
RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)
Call Trace:
xdp_master_redirect (net/core/filter.c:4432)
bpf_prog_run_generic_xdp (include/net/xdp.h:700)
do_xdp_generic (net/core/dev.c:5608)
__netif_receive_skb_one_core (net/core/dev.c:6204)
process_backlog (net/core/dev.c:6319)
__napi_poll (net/core/dev.c:7729)
net_rx_action (net/core/dev.c:7792)
handle_softirqs (kernel/softirq.c:622)
__dev_queue_xmit (include/linux/bottom_half.h:33)
packet_sendmsg (net/packet/af_packet.c:3082)
__sys_sendto (net/socket.c:2252)
Kernel panic - not syncing: Fatal exception in interrupt

The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.

Published: 2026-07-27

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference occurs in the function that handles XDP packet redirection when a bonded device is released from its master. The bug causes the kernel to read from a NULL master pointer, leading to a kernel panic and a reboot. This crash results in a denial of service on the affected host, shutting down all network services running on that system.

Affected Systems

All Linux kernels that contain the current implementation of xdp_master_redirect without the NULL guard are potentially affected. This includes every distribution using such kernels until the commit that adds the guard is applied.

Risk and Exploitability

EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.5 indicates a high severity. Based on the description, it is inferred that an attacker would need to influence network traffic or bonding state during the brief race window when a bond slave is being unlinked. Network-based exploitation could involve sending specially crafted XDP packets to a bonded interface, while a local privileged user could manipulate bonding to trigger the crash. The crash causes a full kernel panic, resulting in complete loss of availability for the host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< c99ca049e910d61ddbd28cc2c47242f2bfbb4970
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< e2a56441233131fe18a76001de347ecda217e40c
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< 3876318ea54e83eb70982b8280a3c5e4e32269bf
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< 4edbcacca09f92b85d3951b6add11894b20a84bc
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< 03b743586a2469744e96e9c1015096d07240935d
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< 89c103d702b25ceb2d097faf854deb47b53b17ff
`879af96ffd72706c6e3278ea6b45b0b0e37ec5d7`	affected	< e82d8cc4321c373dc46e741cd2dfdaa7921fddb7

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,c99ca049e910d61ddbd28cc2c47242f2bfbb4970)`	affected	code_commit	—
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,e2a56441233131fe18a76001de347ecda217e40c)`	affected	code_commit	—
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,3876318ea54e83eb70982b8280a3c5e4e32269bf)`	affected	code_commit	—
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,4edbcacca09f92b85d3951b6add11894b20a84bc)`	affected	code_commit	—
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,03b743586a2469744e96e9c1015096d07240935d)`	affected	code_commit	—
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,89c103d702b25ceb2d097faf854deb47b53b17ff)`	affected	code_commit	—
`[879af96ffd72706c6e3278ea6b45b0b0e37ec5d7,e82d8cc4321c373dc46e741cd2dfdaa7921fddb7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains commit 1921f91298d1 which adds a NULL check before accessing the master device
Until a patch is applied, avoid using XDP programs on bonded interfaces or temporarily disable bonding to prevent the race window that triggers the crash
After applying the patch or disabling the vulnerable feature, reboot the system to ensure the kernel is running the corrected code

Generated by OpenCVE AI on August 4, 2026 at 13:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00496.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d
https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf
https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc
https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff
https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970
https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c
https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7
https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64545-25d6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64545
https://www.cve.org/CVERecord?id=CVE-2026-64545

History

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64545-25d6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64545 https://www.cve.org/CVERecord?id=CVE-2026-64545
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master->flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master->flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up.
Title		net, bpf: check master for NULL in xdp_master_redirect()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970 https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T20:10:36.659Z

Updated: 2026-08-05T12:42:51.710Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64545

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-27T21:17:07.130

Modified: 2026-07-30T06:25:58.200

Link: CVE-2026-64545

Redhat

Severity : Moderate

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64545 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:00:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object