CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: fix null-ptr-deref in xdpmasterredirect() for down master
syzkaller reported a kernel panic in bondrrgenslaveid() reached via xdpmasterredirect(). Full decoded trace:
https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73
bondrrgenslaveid() dereferences bond->rrtxcounter, a per-CPU counter that bonding only allocates in bondopen() when the mode is round-robin. If the bond device was never brought up, rrtxcounter stays NULL.
The XDP redirect path can still reach that code on a bond that was never opened: bpfmasterredirectenabledkey is a global static key, so as soon as any bond device has native XDP attached, the XDPTX -> xdpmasterredirect() interception is enabled for every slave system-wide. The path xdpmasterredirect() -> bondxdpgetxmitslave() -> bondxdpxmitroundrobinslaveget() -> bondrrgenslaveid() then runs against a bond that has no rrtxcounter and crashes.
Fix this in the generic xdpmasterredirect() by refusing to call into the master's ->ndoxdpgetxmitslave() when the master device is not up. IFFUP is only set after ->ndoopen() has successfully returned, so this reliably excludes masters whose XDP state has not been fully initialized. Drop the frame with XDPABORTED so the exception is visible via tracexdpexception() rather than silently falling through. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndoopen() is protected.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are realistically exposed to the crash?
Systems are exposed when a bonding master in round-robin mode has never been brought up and an XDP redirect reaches it through a slave. The triggering condition can exist system-wide once any bond device has native XDP attached, because the relevant redirect interception is controlled by a global static key.
What does exploitation require and what is the impact?
An attacker can trigger a kernel denial of service remotely with low attack complexity and no privileges or user interaction, according to the supplied vector. Exploitation reaches a NULL per-CPU round-robin transmit counter on a bond master that was never opened.
What can be done if the patch cannot be applied immediately?
The vulnerable condition depends on a bond master not being up: its round-robin transmit counter is allocated only when the device is opened. Bringing the affected master device up avoids the specific uninitialized-counter condition described, though applying the available patch is the corrective action.
How can administrators identify whether they are affected?
Review bonding devices configured for round-robin operation that have never been brought up, particularly where XDP is attached to any bond device. A kernel panic trace involving bond_rr_gen_slave_id() reached through xdp_master_redirect() is an indicator that the system has encountered this issue.