CVE-2026-64545

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: check master for NULL in xdp_master_redirect()

xdp_master_redirect() dereferences the result of

netdev_master_upper_dev_get_rcu() without a NULL check, but that helper

returns NULL when the receiving device has no upper-master adjacency.

The reach guard only checks netif_is_bond_slave(). On bond slave release

bond_upper_dev_unlink() drops the upper-master adjacency before clearing

IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window

still passes netif_is_bond_slave() while master is already NULL, and

faults on master->flags at offset 0xb0:

BUG: kernel NULL pointer dereference, address: 00000000000000b0

RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)

Call Trace:

xdp_master_redirect (net/core/filter.c:4432)

bpf_prog_run_generic_xdp (include/net/xdp.h:700)

do_xdp_generic (net/core/dev.c:5608)

__netif_receive_skb_one_core (net/core/dev.c:6204)

process_backlog (net/

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References