Skip to main content

Linux Kernel CVE-2026-53069

| EUVDEUVD-2026-38937 HIGH
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-cc9g-3x8w-qfw5
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.2 MEDIUM

Triggering requires an admin-created non-default XDP-on-down-bond state (PR:H, AC:H) and is reached via adjacent network traffic on the XDP interface (AV:A); impact is kernel-panic DoS only (A:H, C/I:N).

3.1 AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:02 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master

syzkaller reported a kernel panic in bond_rr_gen_slave_id() reached via xdp_master_redirect(). Full decoded trace:

https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73

bond_rr_gen_slave_id() dereferences bond->rr_tx_counter, a per-CPU counter that bonding only allocates in bond_open() when the mode is round-robin. If the bond device was never brought up, rr_tx_counter stays NULL.

The XDP redirect path can still reach that code on a bond that was never opened: bpf_master_redirect_enabled_key is a global static key, so as soon as any bond device has native XDP attached, the XDP_TX -> xdp_master_redirect() interception is enabled for every slave system-wide. The path xdp_master_redirect() -> bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() -> bond_rr_gen_slave_id() then runs against a bond that has no rr_tx_counter and crashes.

Fix this in the generic xdp_master_redirect() by refusing to call into the master's ->ndo_xdp_get_xmit_slave() when the master device is not up. IFF_UP is only set after ->ndo_open() has successfully returned, so this reliably excludes masters whose XDP state has not been fully initialized. Drop the frame with XDP_ABORTED so the exception is visible via trace_xdp_exception() rather than silently falling through. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndo_open() is protected.

AnalysisAI

Denial of service in the Linux kernel network/BPF subsystem allows a NULL-pointer dereference and kernel panic via xdp_master_redirect() when XDP frames are redirected through a bonding master that was never brought up. Because bpf_master_redirect_enabled_key is a global static key, attaching native XDP to any bond device system-wide enables the XDP_TX→xdp_master_redirect() interception for every slave, letting traffic reach bond_rr_gen_slave_id() against a round-robin bond whose per-CPU rr_tx_counter is still NULL (allocated only in bond_open()). Exploitation probability is low (EPSS 0.16%, 6th percentile) and there is no public exploit identified at time of analysis, but the original crash was discovered and reproduced by syzkaller.

Technical ContextAI

The flaw lives in the kernel's generic XDP (eXpress Data Path) redirect machinery and its interaction with the bonding driver. XDP allows BPF programs to process packets in the driver's RX path; when a slave returns XDP_TX, xdp_master_redirect() asks the master via ->ndo_xdp_get_xmit_slave() to pick an egress slave. For a round-robin bond this calls bond_xdp_xmit_roundrobin_slave_get() → bond_rr_gen_slave_id(), which dereferences bond->rr_tx_counter - a per-CPU counter the bonding driver only allocates inside bond_open() (i.e., when the device is administratively brought up). If the bond was never opened, rr_tx_counter remains NULL. The defect is a classic NULL pointer dereference (CWE-476, although the input lists CWE as N/A) caused by a state-initialization ordering assumption: the global static key bpf_master_redirect_enabled_key enables the interception globally as soon as ANY bond has native XDP, so even uninitialized masters can be reached. The fix gates the call on the master's IFF_UP flag (only set after ->ndo_open() succeeds) and drops the frame with XDP_ABORTED, generically protecting any master that defers XDP state allocation to ndo_open. Per the CPE data the affected component is the Linux kernel (cpe:2.3:a:linux:linux).

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10/7.1 (or any later release on your branch) - using the corresponding kernel.org stable commits listed in the advisory (https://git.kernel.org/stable/c/3128b294b426533c8d9162187446d93a8a160359 and the other six stable commits). After patching, IFF_UP is checked before calling the master's ndo_xdp_get_xmit_slave(), so frames destined for an un-opened master are safely dropped with XDP_ABORTED. If immediate patching is not possible, the most direct compensating control is to ensure any bonding master that has native XDP attached is fully brought up (administratively set the bond device UP so bond_open() allocates rr_tx_counter) before XDP-redirecting traffic reaches it - never leave an XDP-attached bond in the down state. Alternatively, detach native XDP programs from bond slaves/masters where they are not strictly required, which disables the global bpf_master_redirect_enabled_key interception path entirely (trade-off: you lose XDP acceleration on those interfaces). Restrict the ability to attach XDP/BPF programs (CAP_NET_ADMIN/CAP_BPF) to trusted administrators to reduce who can place the system into the vulnerable state. Confirm against vendor advisories before relying on any workaround in production.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53069 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy