CVE-2026-45846

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

bareudp_fill_metadata_dst() passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. The socket is only created in bareudp_open() and NULLed in bareudp_stop(), so calling this function while the device is down triggers a NULL dereference via sock->sk.

BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160) Call Trace: <TASK> bareudp_fill_metadata_dst (drivers/net/bareudp.c:532) do_execute_actions (net/openvswitch/actions.c:901) ovs_execute_actions (net/openvswitch/actions.c:1589) ovs_packet_cmd_execute (net/openvswitch/datapath.c:700) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1209) netlink_rcv_skb (net/netlink/af_netlink.c:2550) </TASK>

Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < 31e010a106ff6cd8ccac4bfee547fd3fa1015574; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < 55193df8d6d33318435f19572bf5ea47a22eee28; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < 51eef9c072aa3405a6823a96ae666d38a3b48750; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < a0f4e4e8e0f5e24ddd83e3d1221732621cf34636; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < 35a115a204be08f97450b0389413e218268ef4a2; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < 74a02921c48fcd35a7881956c9e5c52b86595f5d; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < 638905520fc4fae6a80991563f264131545ba3df; >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065, < aa6c6d9ee064aabfede4402fd1283424e649ca19
LinuxLinux5.7

References

Timeline

Published
May 27, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-458475.5In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE when accessing forward path array Although unCVE-2026-458485.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL sock in aa_sock_file_perm Deal with the potential tCVE-2026-458495.5In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj(CVE-2026-45859.8A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the fCVE-2026-458505.5In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum vaCVE-2026-458517.1In the Linux kernel, the following vulnerability has been resolved: efi: Fix reservation of unaccepted memory table The reserve_unacceptedCVE-2026-458527.8In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(),CVE-2026-458537.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memrangesCVE-2026-458545.5In the Linux kernel, the following vulnerability has been resolved: crypto: inside-secure/eip93 - unregister only available algorithm EIP9CVE-2026-458555.5In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: avoid Non-NCQ command starvation When a non-NCQ commCVE-2026-458567.1In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send CVE-2026-458575.5In the Linux kernel, the following vulnerability has been resolved: scsi: csiostor: Fix dereference of null pointer rn The error exit path
CVE-2026-45846: Medium severity, CVSS 5.5 | Vulnix