NULL Dereference Vulnerability in Linux Kernel Affects Networking Components

CVE-2026-63973

What is CVE-2026-63973?

The Linux Kernel contains a vulnerability that leads to potential NULL pointer dereference issues within the networking components. This vulnerability manifests during the queue allocation process, particularly when apc->tx_qp and apc->rxqs are freed without adequate NULL checks. Key functions such as mana_chn_setxdp, mana_destroy_vport, and mana_fence_rqs improperly handle dereferencing these pointers, which may result in system panic. To mitigate these risks, developers have implemented NULL guards in critical code paths, ensuring that the system can handle failure cases more gracefully and avoid crashes.

References