CVE-2026-53069

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master

syzkaller reported a kernel panic in bond_rr_gen_slave_id() reached via

xdp_master_redirect(). Full decoded trace:

https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73

bond_rr_gen_slave_id() dereferences bond->rr_tx_counter, a per-CPU

counter that bonding only allocates in bond_open() when the mode is

round-robin. If the bond device was never brought up, rr_tx_counter

stays NULL.

The XDP redirect path can still reach that code on a bond that was

never opened: bpf_master_redirect_enabled_key is a global static key,

so as soon as any bond device has native XDP attached, the

XDP_TX -> xdp_master_redirect() interception is enabled for every

slave system-wide. The path xdp_master_redirect() ->

bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() ->

bond_rr_gen_slave_id() then runs against a bond that has no

rr_tx_counter and cr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References