CVE-2026-45846: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45846 Overview

CVE-2026-45846 is a NULL pointer dereference vulnerability in the Linux kernel's bareudp driver. The flaw resides in bareudp_fill_metadata_dst(), which passes bareudp->sock to udp_tunnel6_dst_lookup() on the IPv6 path without verifying that the socket pointer is valid. The socket is allocated in bareudp_open() and cleared in bareudp_stop(), so invoking this function while the interface is down causes a kernel NULL dereference via sock->sk. The crash path traverses Open vSwitch action execution and Generic Netlink message handling, making the issue reachable from privileged userspace through the OVS datapath. The vulnerability has been resolved upstream by adding a NULL check that returns -ESHUTDOWN, matching the behavior of the driver's xmit paths.

Critical Impact
A local attacker with the ability to send Open vSwitch netlink commands can trigger a kernel NULL pointer dereference, resulting in a denial-of-service crash of the host.

Affected Products

Linux kernel versions containing the bareudp driver with the unchecked IPv6 path in bareudp_fill_metadata_dst()
Distributions shipping affected stable kernel branches referenced in the upstream fix commits
Systems with Open vSwitch enabled and the bareudp tunnel module loaded

Discovery Timeline

2026-05-27 - CVE-2026-45846 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45846

Vulnerability Analysis

The bareudp driver implements a bare UDP tunnel encapsulation device in the Linux kernel. The function bareudp_fill_metadata_dst() in drivers/net/bareudp.c resolves the destination for outgoing tunneled packets. On the IPv6 code path, the function passes the device's UDP socket directly to udp_tunnel6_dst_lookup() defined in net/ipv6/ip6_udp_tunnel.c.

The socket lifecycle is tied to the device administrative state. The kernel allocates the socket in bareudp_open() and sets the pointer back to NULL in bareudp_stop(). When the interface is administratively down, the socket pointer is therefore NULL. The IPv6 lookup helper dereferences sock->sk without a defensive check, producing the reported crash at address 0x18, which corresponds to the offset of the sk field in struct socket.

The call chain in the bug report shows the path reaches the vulnerable code through ovs_packet_cmd_execute() and do_execute_actions() in the Open vSwitch datapath. An actor with CAP_NET_ADMIN can submit a Generic Netlink message that drives action execution against a bareudp device whose state is down, triggering the dereference [CWE-476].

Root Cause

The root cause is a missing NULL check on bareudp->sock before the IPv6 destination lookup. The xmit paths in the same driver already validated the socket pointer, but bareudp_fill_metadata_dst() did not, creating an inconsistent invariant between transmit and metadata-fill code paths.

Attack Vector

An attacker with privileges sufficient to interact with the Open vSwitch netlink interface can craft an action that invokes bareudp_fill_metadata_dst() against a downed bareudp device. The resulting NULL pointer dereference panics or oopses the kernel, causing denial of service. Remote exploitation is not indicated by the upstream report.

No public proof-of-concept code is referenced in the advisory. The vulnerability mechanism is documented in the upstream commits and the kernel crash trace included in the patch description.

Detection Methods for CVE-2026-45846

Indicators of Compromise

Kernel oops or panic messages referencing udp_tunnel6_dst_lookup at offset corresponding to net/ipv6/ip6_udp_tunnel.c:160
Call traces containing bareudp_fill_metadata_dst, do_execute_actions, and ovs_packet_cmd_execute
BUG: kernel NULL pointer dereference, address: 0000000000000018 entries in dmesg or /var/log/kern.log

Detection Strategies

Monitor kernel ring buffer and syslog for NULL pointer dereference events that include the bareudp and openvswitch modules in the stack trace
Audit hosts running the bareudp module (lsmod | grep bareudp) alongside Open vSwitch to identify exposed systems
Track Generic Netlink activity targeting the OVS family from unexpected processes or namespaces

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM system and alert on repeated oops events involving tunnel drivers
Inventory loaded kernel modules across the fleet and flag hosts running bareudp on kernels predating the fix commits
Correlate netlink socket usage with administrative state changes on bareudp interfaces to detect abuse patterns

How to Mitigate CVE-2026-45846

Immediate Actions Required

Apply the upstream kernel patch that adds the NULL check in bareudp_fill_metadata_dst() and returns -ESHUTDOWN
If patching is not immediately possible, unload the bareudp module on hosts that do not require bare UDP tunneling: modprobe -r bareudp
Restrict CAP_NET_ADMIN and access to the Open vSwitch netlink interface to trusted administrators only

Patch Information

The fix is committed to the Linux stable tree across multiple branches. Refer to the upstream commits: Kernel Git Commit 35a115a, Kernel Git Commit 6389055, Kernel Git Commit 74a0292, Kernel Git Commit a0f4e4e, and Kernel Git Commit aa6c6d9. Distribution-supplied kernels should be updated once vendors backport the fix.

Workarounds

Keep bareudp interfaces administratively up while in use, since the NULL dereference only occurs when the socket has been released via bareudp_stop()
Blacklist the bareudp kernel module on systems that do not require it by adding blacklist bareudp to /etc/modprobe.d/
Limit Open vSwitch datapath usage to vetted control planes and isolate tenants that can submit netlink actions

bash

# Configuration example
# Verify whether the bareudp module is loaded
lsmod | grep bareudp

# Unload the module if it is not in use
sudo modprobe -r bareudp

# Persistently blacklist the module
echo 'blacklist bareudp' | sudo tee /etc/modprobe.d/blacklist-bareudp.conf
sudo update-initramfs -u

# Confirm running kernel version after patching
uname -r