Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow an attacker to cause a system crash (kernel panic). This occurs when processing specific network traffic through a bonded network interface that has not been fully initialized. This issue primarily impacts system availability and could be used to perform a denial-of-service attack.
Technical details
A null pointer dereference exists in the xdp_master_redirect() function within the Linux kernel's BPF/networking component. The vulnerability is triggered when a bonded interface in round-robin mode has not been brought up (IFF_UP is not set), leaving the per-CPU counter 'rr_tx_counter' unallocated. Because bpf_master_redirect_enabled_key is a global static key, XDP traffic can still reach the redirection logic for uninitialized devices, leading to a kernel panic. The fix introduces a check for the IFF_UP flag in xdp_master_redirect() to ensure the master device is fully initialized before proceeding. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux kernel
Timeline
- 2026-04-11: other: Patch submitted by developer
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/183128da0406b1c10e6f60b7b9fe70788b9c8c1d
- https://git.kernel.org/stable/c/1921f91298d1388a0bb9db8f83800c998b649cb3
- https://git.kernel.org/stable/c/3128b294b426533c8d9162187446d93a8a160359
- https://git.kernel.org/stable/c/7bad93e99737e4a5c0c14ac50c05152cf4e28022
- https://git.kernel.org/stable/c/866d3d9b87751b1944168fd82615505e0c0fd6cf
- https://git.kernel.org/stable/c/acbf45bd584d924b320bee2a7fe2a26f64904d95
- https://git.kernel.org/stable/c/ea690b3b6e58ae00979af8195b4cc24df466b65e