CVE-2026-64545

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the Linux kernel within the xdp master redirect() function. The function calls netdev master upper dev get rcu(), which returns NULL when the receiving device lacks upper-master adjacency. Because the reach guard only verifies netif is bond slave(), a race condition occurs during bond slave release where bond upper dev unlink() removes the upper-master adjacency before clearing IFF SLAVE. If an XDP TX reaches xdp master redirect() during this window, it passes the bond slave check while the master is already NULL, leading to a kernel panic when attempting to access master->flags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.