Linux: NULL Pointer Dereference
CVE-2026-64545 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions c99ca049e910d61ddbd28cc2c47242f2bfbb4970, e2a56441233131fe18a76001de347ecda217e40c, 3876318ea54e83eb70982b8280a3c5e4e32269bf as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.59% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c99ca049e910d61ddbd28cc2c47242f2bfbb4970 or e2a56441233131fe18a76001de347ecda217e40c or 3876318ea54e83eb70982b8280a3c5e4e32269bf or 4edbcacca09f92b85d3951b6add11894b20a84bc, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.212 or 6.1.178 or 6.6.145 or 6.12.97, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, c99ca049e910d61ddbd28cc2c47242f2bfbb4970; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, e2a56441233131fe18a76001de347ecda217e40c; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, 3876318ea54e83eb70982b8280a3c5e4e32269bf; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, 4edbcacca09f92b85d3951b6add11894b20a84bc; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, 03b743586a2469744e96e9c1015096d07240935d; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, 89c103d702b25ceb2d097faf854deb47b53b17ff; 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 up to, but not including, e82d8cc4321c373dc46e741cd2dfdaa7921fddb7; 5.15 | c99ca049e910d61ddbd28cc2c47242f2bfbb4970, e2a56441233131fe18a76001de347ecda217e40c, 3876318ea54e83eb70982b8280a3c5e4e32269bf, 4edbcacca09f92b85d3951b6add11894b20a84bc, 03b743586a2469744e96e9c1015096d07240935d, 89c103d702b25ceb2d097faf854deb47b53b17ff |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 5.15 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.40; 6.19 up to, but not including, 7.1.5 | 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master->flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master->flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How developers prevent this class of flaw
- For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
- Select a programming language that is not susceptible to these issues.
- Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d
- git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf
- git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc
- git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff
- git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970
- git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c
- git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7
Third-party and government advisories
- cert-portal.siemens.com/productcert/html/ssa-019113.htmlThird Party Advisory
- cert-portal.siemens.com/productcert/html/ssa-457936.htmlThird Party Advisory
Recent NULL Pointer Dereference vulnerabilities
- 7.0 High severity
- 7.1 High severity
- 8.1 High severity
- 7.5 High severity
- 7.5 High severity
- 8.1 High severity
Spotted an error? Tell us.