CVE-2026-53069 net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
A null pointer dereference in the Linux kernel's XDP redirect path allows local attackers to cause a system crash by triggering a bond device state inconsistency.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53069?
CVE-2026-53069 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
syzkaller reported a kernel panic in bond_rr_gen_slave_id() reached via xdp_master_redirect(). Full decoded trace:
https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73
bond_rr_gen_slave_id() dereferences bond->rr_tx_counter, a per-CPU counter that bonding only allocates in bond_open() when the mode is round-robin. If the bond device was never brought up, rr_tx_counter stays NULL.
The XDP redirect path can still reach that code on a bond that was never opened: bpf_master_redirect_enabled_key is a global static key, so as soon as any bond device has native XDP attached, the XDP_TX -> xdp_master_redirect() interception is enabled for every slave system-wide. The path xdp_master_redirect() -> bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() -> bond_rr_gen_slave_id() then runs against a bond that has no rr_tx_counter and crashes.
Fix this in the generic xdp_master_redirect() by refusing to call into the master's ->ndo_xdp_get_xmit_slave() when the master device is not up. IFF_UP is only set after ->ndo_open() has successfully returned, so this reliably excludes masters whose XDP state has not been fully initialized. Drop the frame with XDP_ABORTED so the exception is visible via trace_xdp_exception() rather than silently falling through. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndo_open() is protected.
Weakness: CWE-476
Which versions are affected by CVE-2026-53069?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53069?
Apply the vendor's patch.
Is CVE-2026-53069 being exploited?
There is no known exploitation of CVE-2026-53069 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53069, DEBIAN-CVE-2026-53069, GHSA-cc9g-3x8w-qfw5, ROOT-OS-DEBIAN-12-CVE-2026-53069, ROOT-OS-UBUNTU-2204-CVE-2026-53069, ROOT-OS-UBUNTU-2404-CVE-2026-53069 and 1 more.