Executive brief
A vulnerability was identified in the Linux kernel's Virtual Routing and Forwarding (VRF) implementation. When a network port is removed from a VRF configuration, a timing issue can occur that causes the system to crash (NULL pointer dereference). This could lead to a denial-of-service condition, impacting the availability of the affected system.
Technical details
A race condition exists in the Linux kernel VRF driver (drivers/net/vrf.c) when unlinking a slave device. RCU readers using netif_is_l3_slave() may assume a subsequent call to netdev_master_upper_dev_get_rcu() returns a valid VRF device with l3mdev operations. Because there is no RCU synchronization after clearing the IFF_L3MDEV_SLAVE flag, a reader might instead see a different master device (like a bridge) that lacks these operations, leading to a NULL pointer dereference in l3mdev_fib_table_rcu. The fix introduces synchronize_net() calls to ensure all RCU readers have completed or see the updated state before proceeding.
Affected products
- Linux Linux kernel fdeea7be88b1 to 2674d603a9e6
Timeline
- 2026-04-23: patched: Initial fix authored by Ido Schimmel
- 2026-06-24: disclosed: CVE-2026-52925 published
References
- https://git.kernel.org/stable/c/2674d603a9e6970463b2b9ebcf8e31e90beae169
- https://git.kernel.org/stable/c/2c022f582fd16a470df6ed9e7fb7e9fc48946d49
- https://git.kernel.org/stable/c/3db8d078f7f652379ee394132b169d304f6eb4c1
- https://git.kernel.org/stable/c/468defa0b70902a22f4478c1207624bc1b31c124
- https://git.kernel.org/stable/c/4ab6fc60ed5a0344b60711b09bff1dc238d8d6a4
- https://git.kernel.org/stable/c/8c2b792f04a3db97c9d8d2a45817e93f8884baf5
- https://git.kernel.org/stable/c/a7a97f2303e63ede105c1d55ef53dc497364e11d