Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-45846

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() bareudp_fill_metadata_dst() passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. The socket is only created in bareudp_open() and NULLed in bareudp_stop(), so calling this function while the device is down triggers a NULL dereference via sock->sk. BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160) Call Trace: <TASK> bareudp_fill_metadata_dst (drivers/net/bareudp.c:532) do_execute_actions (net/openvswitch/actions.c:901) ovs_execute_actions (net/openvswitch/actions.c:1589) ovs_packet_cmd_execute (net/openvswitch/datapath.c:700) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1209) netlink_rcv_skb (net/netlink/af_netlink.c:2550) </TASK> Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < 31e010a106ff6cd8ccac4bfee547fd3fa1015574affected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < 55193df8d6d33318435f19572bf5ea47a22eee28affected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < 51eef9c072aa3405a6823a96ae666d38a3b48750affected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < a0f4e4e8e0f5e24ddd83e3d1221732621cf34636affected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < 35a115a204be08f97450b0389413e218268ef4a2affected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < 74a02921c48fcd35a7881956c9e5c52b86595f5daffected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < 638905520fc4fae6a80991563f264131545ba3dfaffected
  • 571912c69f0ed731bd1e071ade9dc7ca4aa52065 to < aa6c6d9ee064aabfede4402fd1283424e649ca19affected

Linux Linux

Default version status: affected

  • 5.7affected
  • 0 to < 5.7unaffected
  • 5.10.258 to ≤ 5.10.*unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.141 to ≤ 6.6.*unaffected
  • 6.12.91 to ≤ 6.12.*unaffected
  • 6.18.33 to ≤ 6.18.*unaffected
  • 7.0.10 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References