{"id":"CVE-2026-45846","title":"bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()\n\nbareudp_fill_metadata_dst() passes bareudp->sock to\nudp_tunnel6_dst_lookup() in the IPv6 path with…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 31e010a106ff6cd8ccac4bfee547fd3fa1015574","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 55193df8d6d33318435f19572bf5ea47a22eee28","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 51eef9c072aa3405a6823a96ae666d38a3b48750","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < a0f4e4e8e0f5e24ddd83e3d1221732621cf34636","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 35a115a204be08f97450b0389413e218268ef4a2","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 74a02921c48fcd35a7881956c9e5c52b86595f5d","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 638905520fc4fae6a80991563f264131545ba3df","Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < aa6c6d9ee064aabfede4402fd1283424e649ca19","Linux 5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:42:11.877292Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:59.576Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45846","references":[{"url":"https://git.kernel.org/stable/c/31e010a106ff6cd8ccac4bfee547fd3fa1015574"},{"url":"https://git.kernel.org/stable/c/55193df8d6d33318435f19572bf5ea47a22eee28"},{"url":"https://git.kernel.org/stable/c/51eef9c072aa3405a6823a96ae666d38a3b48750"},{"url":"https://git.kernel.org/stable/c/a0f4e4e8e0f5e24ddd83e3d1221732621cf34636"},{"url":"https://git.kernel.org/stable/c/35a115a204be08f97450b0389413e218268ef4a2"},{"url":"https://git.kernel.org/stable/c/74a02921c48fcd35a7881956c9e5c52b86595f5d"},{"url":"https://git.kernel.org/stable/c/638905520fc4fae6a80991563f264131545ba3df"},{"url":"https://git.kernel.org/stable/c/aa6c6d9ee064aabfede4402fd1283424e649ca19"}],"tags":["cve.org"],"epss":0.00127,"epssPercentile":0.02393,"ingestedAt":"2026-11-06T15:54:03.877Z","slug":"CVE-2026-45846","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()\n\nbareudp_fill_metadata_dst() passes bareudp->sock to\nudp_tunnel6_dst_lookup() in the IPv6 path without a NULL check.\nThe socket is only created in bareudp_open() and NULLed in\nbareudp_stop(), so calling this function while the device is down\ntriggers a NULL dereference via sock->sk.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160)\n Call Trace:\n  <TASK>\n  bareudp_fill_metadata_dst (drivers/net/bareudp.c:532)\n  do_execute_actions (net/openvswitch/actions.c:901)\n  ovs_execute_actions (net/openvswitch/actions.c:1589)\n  ovs_packet_cmd_execute (net/openvswitch/datapath.c:700)\n  genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)\n  genl_rcv_msg (net/netlink/genetlink.c:1209)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  </TASK>\n\nAdd a NULL check returning -ESHUTDOWN, consistent with the xmit paths\nin the same driver.\n\n## Affected\n\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 31e010a106ff6cd8ccac4bfee547fd3fa1015574`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 55193df8d6d33318435f19572bf5ea47a22eee28`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 51eef9c072aa3405a6823a96ae666d38a3b48750`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < a0f4e4e8e0f5e24ddd83e3d1221732621cf34636`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 35a115a204be08f97450b0389413e218268ef4a2`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 74a02921c48fcd35a7881956c9e5c52b86595f5d`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 638905520fc4fae6a80991563f264131545ba3df`\n- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < aa6c6d9ee064aabfede4402fd1283424e649ca19`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}