Network Device Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-52925

What is CVE-2026-52925?

A vulnerability in the network device management of the Linux Kernel can lead to a null pointer dereference (NPD) under certain conditions. When a port is removed from a Virtual Routing and Forwarding (VRF) instance, assumptions made by RCU (Read-Copy-Update) readers could be violated, resulting in potential crashes or unpredictable behavior. This occurs when a reader that identifies a net device as a VRF port continues operations assuming the VRF device will remain constant, which isn't guaranteed during removal operations. The vulnerability has been addressed by introducing proper RCU synchronization protocols to ensure that the system behavior remains stable when ports are dynamically altered.

References