Skip to main content

Linux Kernel CVE-2026-45846

| EUVDEUVD-2026-32172 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-48q6-hpwm-mqh2
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access via OVS netlink requires PR:L; no confidentiality or integrity impact - kernel panic only causes availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 25, 2026 - 23:16 vuln.today
CVSS changed
Jun 25, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 11:16 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 11:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

bareudp_fill_metadata_dst() passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. The socket is only created in bareudp_open() and NULLed in bareudp_stop(), so calling this function while the device is down triggers a NULL dereference via sock->sk.

BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160) Call Trace: <TASK> bareudp_fill_metadata_dst (drivers/net/bareudp.c:532) do_execute_actions (net/openvswitch/actions.c:901) ovs_execute_actions (net/openvswitch/actions.c:1589) ovs_packet_cmd_execute (net/openvswitch/datapath.c:700) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1209) netlink_rcv_skb (net/netlink/af_netlink.c:2550) </TASK>

Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver.

AnalysisAI

NULL pointer dereference in the Linux kernel bareudp driver crashes the kernel when Open vSwitch triggers bareudp_fill_metadata_dst() against a down IPv6 bareudp tunnel device. The socket pointer (bareudp->sock) is NULL between bareudp_stop() and bareudp_open(), and the IPv6 path passes it unsafely to udp_tunnel6_dst_lookup() at sock->sk offset 0x18. A local attacker with low privileges and access to OVS netlink commands can force a kernel panic, causing a denial of service. No public exploit code exists and no active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms negligible observed exploitation.

Technical ContextAI

The bareudp driver (drivers/net/bareudp.c) implements a generic UDP tunnel that can encapsulate arbitrary Layer 3 protocols, introduced in Linux 5.7. In bareudp_fill_metadata_dst(), the IPv6 routing path calls udp_tunnel6_dst_lookup() passing bareudp->sock directly without a NULL guard. The socket lifecycle is tied to device state: allocated in bareudp_open() and freed and NULLed in bareudp_stop(). When a bareudp device is administratively downed, the socket is NULL, but OVS action execution (do_execute_actions → ovs_execute_actions → ovs_packet_cmd_execute) can still invoke this code path via a generic netlink OVS_PACKET_CMD_EXECUTE message. The dereference at offset 0x18 (sock->sk) triggers a hard kernel NULL pointer dereference (CWE-476). The fix adds a NULL check returning -ESHUTDOWN, consistent with existing NULL guards in the driver's xmit paths. CPE cpe:2.3:o:linux:linux_kernel:* confirms the entire kernel is the affected product.

RemediationAI

Upgrade to a patched stable kernel release: 6.6.141 or later for 6.6.x branch users, 6.12.91 or later for 6.12.x branch users, 7.0.10 or later for 7.0.x users, and 7.1-rc2 or later for 7.1 pre-release users, per EUVD-2026-32172. Patch commits are indexed at git.kernel.org stable tree (see references). If an immediate kernel upgrade is operationally infeasible, restrict access to OVS netlink sockets to trusted administrative users only, as unprivileged access to OVS_PACKET_CMD_EXECUTE is required to reach the vulnerable code path - this limits exposure at the cost of restricting OVS management. Alternatively, unloading the bareudp kernel module (modprobe -r bareudp) eliminates the attack surface entirely for environments not using bareudp tunnels, with the trade-off of losing bareudp UDP tunnel encapsulation functionality. Ensuring bareudp devices are never left in the DOWN state while OVS is processing actions against them is an operational mitigation, but is fragile and not a substitute for patching.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.158 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.144 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.173 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.144 Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-EC2 Image SLES-GCE Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-45846 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy