CVE-2026-52925

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Null Pointer Dereference (NPD) can occur when removing a port from a Virtual Routing and Forwarding (VRF) instance. RCU readers using netif is l3 slave() may incorrectly assume that netdev master upper dev get rcu() returns a VRF device and subsequently dereference its l3mdev operations. Due to a lack of RCU synchronization during port removal, a reader might encounter a new master device, such as a bridge, that lacks l3mdev operations, leading to the crash. This issue was observed in the l3mdev fib table rcu() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.