CVE-2026-52925: linux NULL Pointer Dereference
Vulnerability summary
CVE-2026-52925 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 50 · Related 50Timeline
- 24-06-2026PublishedVulnerability first disclosed.
Description
In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from a VRF RCU readers that identified a net device as a VRF port using netif_is_l3_slave() assume that a subsequent call to netdev_master_upper_dev_get_rcu() will return a VRF device. They then continue to dereference its l3mdev operations. This assumption is not always correct and can result in a NPD [1]. There is no RCU synchronization when removing a port from a VRF, so it is possible for an RCU reader to see a new master device (e.g., a bridge) that does not have l3mdev operations. Fix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE flag. Skip this synchronization when a net device is removed from a VRF as part of its deletion and when the VRF device itself is deleted. In the latter case an RCU grace period will pass by the time RTNL is released. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181) [...] Call Trace: <TASK> l3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189) __inet_bind (net/ipv4/af_inet.c:499 (discriminator 3)) inet_bind_sk (net/ipv4/af_inet.c:469) __sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1)) __x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
0.00 pp
From 0.11% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu165 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136 | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64 | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < 2c022f582fd16a470df6ed9e7fb7e9fc48946d49 | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < 4ab6fc60ed5a0344b60711b09bff1dc238d8d6a4 | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < 468defa0b70902a22f4478c1207624bc1b31c124 | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < 3db8d078f7f652379ee394132b169d304f6eb4c1 | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < 8c2b792f04a3db97c9d8d2a45817e93f8884baf5 | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < a7a97f2303e63ede105c1d55ef53dc497364e11d | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < d47204c127992da0c976ac9747070a575912e0fe | ≥ fdeea7be88b12742bfd50d9e19a06c0d2e702400, < 2674d603a9e6970463b2b9ebcf8e31e90beae169 | 4.12
- linux_kernel≥ 4.12, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10 | 7.1:rc1
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1
3 vendors · 168 products
