CVE-2026-93286: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
In the Linux kernel, the following vulnerability has been resolved:
net: appletalk: fix NULL pointer dereference in aarpsendddp()
aarpsendddp() calls atalkfinddevaddr(dev) in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured (dev->atalkptr == NULL), this leads to a NULL pointer dereference at the at->snet access.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:aarpsendddp (net/appletalk/aarp.c:552 (discriminator 2)) Call Trace: <TASK> atalksendmsg (net/appletalk/ddp.c:1715) syssendto (net/socket.c:2265 (discriminator 1)) x64syssendto (net/socket.c:2272) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121)
Add a NULL check consistent with the other callers of atalkfinddevaddr().
Affected Software
Event History
Frequently Asked Questions
What condition triggers the crash?
The crash occurs when aarp_send_ddp() takes the LocalTalk fast path for a device that has no AppleTalk interface configured, leaving dev->atalk_ptr as NULL. The function then dereferences the NULL result of atalk_find_dev_addr(dev).
What access is involved in reaching the vulnerable code?
The provided call trace shows the path is reached through an AppleTalk send operation: atalk_sendmsg() followed by the sendto system call. The data does not establish whether an unprivileged local user can create the required socket and device conditions.
How can systems mitigate the issue before applying the fix?
Avoid using the affected AppleTalk LocalTalk send path on devices without an AppleTalk interface configured. The fix adds a NULL check in aarp_send_ddp(), consistent with other callers of atalk_find_dev_addr().