Skip to main content

Linux Kernel EUVDEUVD-2026-49596

| CVE-2026-64545 HIGH
2026-07-27 Linux GHSA-5fp4-82x6-8894
Denial Of Service Linux
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.8 MEDIUM

Crash needs a narrow bond-teardown race (AC:H) plus attacker-adjacent traffic (AV:A) on a host an operator configured with generic XDP over bonding (PR:L); availability-only impact.

3.1 AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 06:49 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:10 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: check master for NULL in xdp_master_redirect()

xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency.

The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master->flags at offset 0xb0:

BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt

The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master->flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up.

AnalysisAI

Denial of service in the Linux kernel XDP generic receive path allows a NULL pointer dereference and kernel panic when a bond slave interface is released while XDP redirect processing is in flight. The affected code, xdp_master_redirect() in net/core/filter.c, guards only on netif_is_bond_slave() but dereferences the master device that bond_upper_dev_unlink() has already cleared, faulting on master->flags at offset 0xb0. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the issue is a race-window crash rather than a memory-disclosure or code-execution bug.

Technical ContextAI

The flaw lives in the eXpress Data Path (XDP) generic software path (bpf_prog_run_generic_xdp → do_xdp_generic), where an XDP program returns XDP_TX/XDP_REDIRECT and the kernel attempts to redirect to a bonding master via netdev_master_upper_dev_get_rcu(). That helper legitimately returns NULL when a device has no upper-master adjacency. The root cause is a classic NULL pointer dereference (CWE-476) combined with a time-of-check/time-of-use race: on bond slave release, bond_upper_dev_unlink() removes the upper-master adjacency BEFORE clearing IFF_SLAVE, so netif_is_bond_slave() still returns true while the master pointer is already NULL. Commit 1921f91298d1 previously added the master->flags read that now faults, without adding a NULL guard, and the underlying unconditional dereference dates to the original code. The CPE data identifies the generic 'linux:linux' product; the affected code is in the core networking stack (net/core), not a driver.

RemediationAI

Vendor-released patch: update to the fixed stable release for your branch - 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (fix also in 7.2-rc1) - via your distribution's kernel update, or apply the stable commit for your tree from git.kernel.org (e.g. https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970). Where immediate patching is not possible, the practical compensating control is to avoid generic (SKB-mode) XDP on interfaces that are bonding slaves, or avoid attaching XDP programs to bonded interfaces at all until patched; native/driver XDP and non-bonded setups are not on this path. Trade-off: disabling XDP on those interfaces removes any XDP-based filtering/acceleration you rely on. Avoiding dynamic bond slave add/remove operations on production hosts running XDP narrows the race window but is operationally fragile and should be treated as a stopgap only.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-49596 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy