CVE-2026-52925

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vrf: Fix a potential NPD when removing a port from a VRF

RCU readers that identified a net device as a VRF port using

netif_is_l3_slave() assume that a subsequent call to

netdev_master_upper_dev_get_rcu() will return a VRF device. They then

continue to dereference its l3mdev operations.

This assumption is not always correct and can result in a NPD [1]. There

is no RCU synchronization when removing a port from a VRF, so it is

possible for an RCU reader to see a new master device (e.g., a bridge)

that does not have l3mdev operations.

Fix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE

flag. Skip this synchronization when a net device is removed from a VRF

as part of its deletion and when the VRF device itself is deleted. In

the latter case an RCU grace period will pass by the time RTNL is

released.

[1]

BUG: kernel NULL pointer dereference, address: 0000000000000000

[...]

RIP: 0010:l3mdev_fib_table_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References