Null Pointer Dereference in Linux Kernel's BareUDP Component

CVE-2026-45846

What is CVE-2026-45846?

A vulnerability exists in the BareUDP implementation of the Linux kernel, where the function bareudp_fill_metadata_dst() fails to check for a NULL socket pointer before invoking udp_tunnel6_dst_lookup(). This lack of NULL check can lead to a kernel NULL pointer dereference error when executing the function while the device is down, resulting in operational instability. The vulnerability is primarily triggered during specific transmission paths and poses risks to system reliability and performance.

References