High 7.5Published Jul 27, 2026

CVE-2026-64545net, bpf: check master for NULL in xdp_master_redirect()

Updated under an hour ago (Oct 26, 2026, 2:23 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master->flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master->flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 before c99ca049e910d61ddbd28cc2c47242f2bfbb4970; from 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 before e2a56441233131fe18a76001de347ecda217e40c; from 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 before 3876318ea54e83eb70982b8280a3c5e4e32269bf; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 builds before 4edbcacca09f92b85d3951b6add11894b20a84bc; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 builds before 03b743586a2469744e96e9c1015096d07240935d; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 builds before 89c103d702b25ceb2d097faf854deb47b53b17ff; from 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 before e82d8cc4321c373dc46e741cd2dfdaa7921fddb7	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP

References

References

https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970
https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c
https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf
https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc
https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d
https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff
https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.