Look up another CVE · open CVE-2026-53069 in the interactive tracker
CVE-2026-53069
net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem net/core. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53069 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
syzkaller reported a kernel panic in bond_rr_gen_slave_id() reached via xdp_master_redirect(). Full decoded trace: https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73 bond_rr_gen_slave_id() dereferences bond->rr_tx_counter, a per-CPU counter that bonding only allocates in bond_open() when the mode is round-robin. If the bond device was never brought up, rr_tx_counter stays NULL. The XDP redirect path can still reach that code on a bond that was never opened: bpf_master_redirect_enabled_key is a global static key, so as soon as any bond device has native XDP attached, the XDP_TX -> xdp_master_redirect() interception is enabled for every slave system-wide. The path xdp_master_redirect() -> bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() -> bond_rr_gen_slave_id() then runs against a bond that has no rr_tx_counter and crashes. Fix this in the generic xdp_master_redirect() by refusing to call into the master's ->ndo_xdp_get_xmit_slave() when the master device is not up. IFF_UP is only set after ->ndo_open() has successfully returned, so this reliably excludes masters whose XDP state has not been fully initialized. Drop the frame with XDP_ABORTED so the exception is visible via trace_xdp_exception() rather than silently falling through. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndo_open() is protected.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/core/filter.c
- What this is
- BPF [GENERAL] (Safe Dynamic Programs and Tools)MAINTAINERS section matched on net/core/filter.c · bpf@vger.kernel.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.38%, higher than 30.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 5.15.209 | 3128b294b426 |
| 5.15 | 6.1.175 | acbf45bd584d |
| 5.15 | 6.6.141 | 866d3d9b8775 |
| 5.15 | 6.12.91 | 183128da0406 |
| 5.15 | 6.18.33 | 7bad93e99737 |
| 5.15 | 7.0.10 | ea690b3b6e58 |
| 5.15 | 7.1 | 1921f91298d1 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable XDP receive path can be reached by packets arriving on a bonding slave when the installed XDP program returns XDP_TX. A local BPF_PROG_TEST_RUN trigger also exists, but Network is the higher defensible vector for a deployed XDP/bonding system.
- AC:LAttack complexity, low
- There is no race or heap-shaping requirement; once the affected bond/XDP state exists, an XDP_TX packet deterministically reaches the NULL rr_tx_counter dereference. The attacker only needs to supply traffic matching the XDP_TX path.
- PR:NPrivileges required, none
- In the network-triggered scenario, the attacker needs no account or kernel capabilities on the target and only sends packets to the affected interface. Local setup paths require capabilities, but they are not required for the remote packet trigger on an already vulnerable deployment.
- UI:NUser interaction, none
- No victim user action is needed once the affected bond/XDP configuration is present. Packet delivery or BPF test execution triggers the fault directly.
- S:UScope, unchanged
- The impact is within the same kernel security authority. There is no VM escape, IOMMU bypass, or other cross-scope boundary crossing.
- C:NConfidentiality impact, none
- The bug is a NULL pointer dereference of bonding's unallocated per-CPU rr_tx_counter. It does not expose kernel memory or provide a read primitive.
- I:NIntegrity impact, none
- The dereferenced pointer is NULL and not attacker-controlled, so this is not an arbitrary write or control-flow corruption primitive. The demonstrated effect is a crash.
- A:HAvailability impact, high
- The NULL dereference causes a kernel oops/panic in bond_rr_gen_slave_id(). This is a high availability impact.