CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: check master for NULL in xdp_master_redirect()

xdp_master_redirect() dereferences the result of
netdev_master_upper_dev_get_rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.

The reach guard only checks netif_is_bond_slave(). On bond slave release
bond_upper_dev_unlink() drops the upper-master adjacency before clearing
IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window
still passes netif_is_bond_slave() while master is already NULL, and
faults on master->flags at offset 0xb0:

  BUG: kernel NULL pointer dereference, address: 00000000000000b0
  RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)
  Call Trace:
   xdp_master_redirect (net/core/filter.c:4432)
   bpf_prog_run_generic_xdp (include/net/xdp.h:700)
   do_xdp_generic (net/core/dev.c:5608)
   __netif_receive_skb_one_core (net/core/dev.c:6204)
   process_backlog (net/core/dev.c:6319)
   __napi_poll (net/core/dev.c:7729)
   net_rx_action (net/core/dev.c:7792)
   handle_softirqs (kernel/softirq.c:622)
   __dev_queue_xmit (include/linux/bottom_half.h:33)
   packet_sendmsg (net/packet/af_packet.c:3082)
   __sys_sendto (net/socket.c:2252)
  Kernel panic - not syncing: Fatal exception in interrupt

The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.

The Linux kernel CVE team has assigned CVE-2026-64545 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 5.15.212 with commit c99ca049e910d61ddbd28cc2c47242f2bfbb4970
	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 6.1.178 with commit e2a56441233131fe18a76001de347ecda217e40c
	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 6.6.145 with commit 3876318ea54e83eb70982b8280a3c5e4e32269bf
	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 6.12.97 with commit 4edbcacca09f92b85d3951b6add11894b20a84bc
	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 6.18.40 with commit 03b743586a2469744e96e9c1015096d07240935d
	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 7.1.5 with commit 89c103d702b25ceb2d097faf854deb47b53b17ff
	Issue introduced in 5.15 with commit 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 and fixed in 7.2-rc1 with commit e82d8cc4321c373dc46e741cd2dfdaa7921fddb7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64545
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/filter.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970
	https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c
	https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf
	https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc
	https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d
	https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff
	https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7