AZL-88773
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-88773.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-88773
- Upstream
- Published
- 2026-05-27T11:16:24Z
- Modified
- 2026-08-28T17:48:09.859393396Z
- Summary
- CVE-2026-45846 affecting package kernel for versions less than 6.6.141.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bareudp: fix NULL pointer dereference in bareudpfillmetadata_dst()
bareudpfillmetadatadst() passes bareudp->sock to udptunnel6dstlookup() in the IPv6 path without a NULL check. The socket is only created in bareudpopen() and NULLed in bareudpstop(), so calling this function while the device is down triggers a NULL dereference via sock->sk.
BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udptunnel6dstlookup (net/ipv6/ip6udptunnel.c:160) Call Trace: <TASK> bareudpfillmetadatadst (drivers/net/bareudp.c:532) doexecuteactions (net/openvswitch/actions.c:901) ovsexecuteactions (net/openvswitch/actions.c:1589) ovspacketcmdexecute (net/openvswitch/datapath.c:700) genlfamilyrcvmsgdoit (net/netlink/genetlink.c:1114) genlrcvmsg (net/netlink/genetlink.c:1209) netlinkrcvskb (net/netlink/afnetlink.c:2550) </TASK>
Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver.
- References