CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect()

In the Linux kernel, the following vulnerability has been resolved:

net, bpf: check master for NULL in xdpmasterredirect()

xdpmasterredirect() dereferences the result of netdevmasterupperdevgetrcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency.

The reach guard only checks netifisbondslave(). On bond slave release bondupperdevunlink() drops the upper-master adjacency before clearing IFFSLAVE, so an XDPTX reaching xdpmasterredirect() in that window still passes netifisbondslave() while master is already NULL, and faults on master->flags at offset 0xb0:

BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdpmasterredirect (net/core/filter.c:4432) Call Trace: xdpmasterredirect (net/core/filter.c:4432) bpfprogrungenericxdp (include/net/xdp.h:700) doxdpgeneric (net/core/dev.c:5608) netifreceiveskbonecore (net/core/dev.c:6204) processbacklog (net/core/dev.c:6319) napipoll (net/core/dev.c:7729) netrxaction (net/core/dev.c:7792) handlesoftirqs (kernel/softirq.c:622) devqueuexmit (include/linux/bottomhalf.h:33) packetsendmsg (net/packet/afpacket.c:3082) syssendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt

The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdpmasterredirect() for down master") later added the master->flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up.