---
id: CVE-2026-45846
title: 'bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

  bareudp_fill_metadata_dst() passes bareudp->sock to
  udp_tunnel6_dst_lookup() in the IPv6 path with…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    31e010a106ff6cd8ccac4bfee547fd3fa1015574
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    55193df8d6d33318435f19572bf5ea47a22eee28
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    51eef9c072aa3405a6823a96ae666d38a3b48750
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    a0f4e4e8e0f5e24ddd83e3d1221732621cf34636
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    35a115a204be08f97450b0389413e218268ef4a2
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    74a02921c48fcd35a7881956c9e5c52b86595f5d
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    638905520fc4fae6a80991563f264131545ba3df
  - >-
    Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 <
    aa6c6d9ee064aabfede4402fd1283424e649ca19
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:42:11.877292Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:59.576Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45846'
references:
  - url: 'https://git.kernel.org/stable/c/31e010a106ff6cd8ccac4bfee547fd3fa1015574'
  - url: 'https://git.kernel.org/stable/c/55193df8d6d33318435f19572bf5ea47a22eee28'
  - url: 'https://git.kernel.org/stable/c/51eef9c072aa3405a6823a96ae666d38a3b48750'
  - url: 'https://git.kernel.org/stable/c/a0f4e4e8e0f5e24ddd83e3d1221732621cf34636'
  - url: 'https://git.kernel.org/stable/c/35a115a204be08f97450b0389413e218268ef4a2'
  - url: 'https://git.kernel.org/stable/c/74a02921c48fcd35a7881956c9e5c52b86595f5d'
  - url: 'https://git.kernel.org/stable/c/638905520fc4fae6a80991563f264131545ba3df'
  - url: 'https://git.kernel.org/stable/c/aa6c6d9ee064aabfede4402fd1283424e649ca19'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02393
ingestedAt: '2026-11-06T15:54:03.877Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

bareudp_fill_metadata_dst() passes bareudp->sock to
udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check.
The socket is only created in bareudp_open() and NULLed in
bareudp_stop(), so calling this function while the device is down
triggers a NULL dereference via sock->sk.

 BUG: kernel NULL pointer dereference, address: 0000000000000018
 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160)
 Call Trace:
  <TASK>
  bareudp_fill_metadata_dst (drivers/net/bareudp.c:532)
  do_execute_actions (net/openvswitch/actions.c:901)
  ovs_execute_actions (net/openvswitch/actions.c:1589)
  ovs_packet_cmd_execute (net/openvswitch/datapath.c:700)
  genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)
  genl_rcv_msg (net/netlink/genetlink.c:1209)
  netlink_rcv_skb (net/netlink/af_netlink.c:2550)
  </TASK>

Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths
in the same driver.

## Affected

- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 31e010a106ff6cd8ccac4bfee547fd3fa1015574`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 55193df8d6d33318435f19572bf5ea47a22eee28`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 51eef9c072aa3405a6823a96ae666d38a3b48750`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < a0f4e4e8e0f5e24ddd83e3d1221732621cf34636`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 35a115a204be08f97450b0389413e218268ef4a2`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 74a02921c48fcd35a7881956c9e5c52b86595f5d`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < 638905520fc4fae6a80991563f264131545ba3df`
- `Linux >= 571912c69f0ed731bd1e071ade9dc7ca4aa52065 < aa6c6d9ee064aabfede4402fd1283424e649ca19`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.