CVE-2026-64545: Linux Kernel XDP Redirect Vulnerability

CVE-2026-64545 Overview

CVE-2026-64545 is a NULL pointer dereference vulnerability in the Linux kernel's network subsystem, specifically in the xdp_master_redirect() function within net/core/filter.c. The function dereferences the result of netdev_master_upper_dev_get_rcu() without checking for NULL, even though that helper returns NULL when the receiving device has no upper-master adjacency. A race window during bond slave release allows an XDP_TX path to reach xdp_master_redirect() while master is already NULL, triggering a kernel panic. The vulnerability is reachable through eXpress Data Path (XDP) processing of network traffic.

Critical Impact
Remote attackers can trigger a kernel NULL pointer dereference through crafted network traffic during bond slave teardown, causing a fatal exception in interrupt context and full system denial of service.

Affected Products

Linux kernel branches containing the xdp_master_redirect() code path
Systems using bonding drivers with XDP-enabled slave interfaces
Generic XDP configurations processing traffic via bpf_prog_run_generic_xdp()

Discovery Timeline

2026-07-27 - CVE-2026-64545 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64545

Vulnerability Analysis

The defect lives in xdp_master_redirect() at net/core/filter.c:4432. The function calls netdev_master_upper_dev_get_rcu() to obtain the master netdevice for a bond slave, then dereferences the returned pointer to read master->flags. The helper legitimately returns NULL when no upper-master adjacency exists, but the caller never validates the return value.

The reachability guard checks only netif_is_bond_slave(). During bond slave release, bond_upper_dev_unlink() removes the upper-master adjacency before clearing the IFF_SLAVE flag. Any XDP_TX packet that reaches xdp_master_redirect() inside this window still satisfies netif_is_bond_slave() while master has already become NULL. The read of master->flags at offset 0xb0 then faults.

The resulting kernel panic — BUG: kernel NULL pointer dereference, address: 00000000000000b0 — occurs in softirq context via net_rx_action() and handle_softirqs(), producing a fatal exception in interrupt that halts the system.

Root Cause

The root cause is a missing NULL check combined with a TOCTOU-style ordering issue between adjacency teardown and slave flag clearing [CWE-476]. Commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") previously added the master->flags read but kept the unconditional dereference from the original code.

Attack Vector

An attacker with the ability to send network packets to an XDP-enabled bond slave can influence the code path. Triggering the fault requires a concurrent bond slave release, which enlarges the exploitation window on systems that reconfigure bonding dynamically. Because the fault occurs in interrupt context, no local access or authentication is required.

The fix, delivered across kernel git commits 03b7435, 3876318, 4edbca0, 89c103d, c99ca04, e2a5644, and e82d8cc, adds a NULL check for master before use and treats a NULL master identically to a master that is not up.

Detection Methods for CVE-2026-64545

Indicators of Compromise

Kernel panic log entries citing NULL pointer dereference, address: 00000000000000b0
Crash stack traces including xdp_master_redirect, bpf_prog_run_generic_xdp, and do_xdp_generic
Unexpected host reboots correlated with bond interface reconfiguration events
dmesg output showing Kernel panic - not syncing: Fatal exception in interrupt under network load

Detection Strategies

Monitor kernel ring buffer and /var/log/kern.log for oops signatures referencing xdp_master_redirect
Correlate bonding events (bond_upper_dev_unlink, slave add/remove) with XDP program attachments
Track kernel version and patch level against the upstream fix commits listed in the NVD references

Monitoring Recommendations

Enable persistent kernel crash dump collection (kdump) on hosts running XDP-attached bond interfaces
Ship kernel logs to a centralized platform for cross-host correlation of panic signatures
Alert on repeated node reboots on Kubernetes or virtualization hosts using bonded XDP data paths

How to Mitigate CVE-2026-64545

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 03b7435, 3876318, 4edbca0, 89c103d, c99ca04, e2a5644, and e82d8cc
Inventory hosts running XDP programs attached to bond slaves and prioritize them for patching
Restrict administrative access to bonding configuration to reduce concurrent teardown windows

Patch Information

The fix adds a NULL check on the pointer returned by netdev_master_upper_dev_get_rcu() inside xdp_master_redirect(). When master is NULL, the code now takes the same path as a master that is not up, avoiding the dereference at offset 0xb0. Distribution-supplied kernels backporting any of the referenced commits address the issue. See the Kernel Git Commit 03b7435 and Kernel Git Commit e82d8cc for the canonical fixes.

Workarounds

Detach XDP programs from bond slave interfaces until the kernel patch is deployed
Avoid dynamic bond slave add or remove operations on hosts running generic XDP
Where feasible, switch traffic paths off generic XDP (do_xdp_generic) on affected hosts

bash

# Detach generic XDP from a bond slave interface as a temporary workaround
ip link set dev eth0 xdpgeneric off

# Verify no XDP program remains attached
ip -details link show dev eth0 | grep -i xdp