CVE-2026-45846

What it actually does

This is a Linux kernel denial-of-service flaw in the Bare UDP tunnel driver. In the IPv6 metadata destination lookup path, bareudp_fill_metadata_dst() can pass a NULL bareudp socket pointer to udp_tunnel6_dst_lookup() when the Bare UDP network device is down. The resulting NULL pointer dereference occurs in kernel context and can trigger a kernel oops or panic, depending on system panic-on-oops configuration. The issue is local and requires low-privileged local ability to trigger the relevant Open vSwitch/netlink packet execution path; it does not provide confidentiality or integrity impact by itself.

Why it matters to the business

An attacker with local access to an affected Linux system can crash the host or disrupt networking workloads that depend on the kernel, Bare UDP tunneling, or Open vSwitch. In production environments this can cause service outages, workload restarts, node eviction, loss of network connectivity, or high-availability failover events. The CVSS score is moderate, EPSS is very low, it is not currently listed in CISA KEV, and no public exploit maturity is reported, so urgency is highest for multi-user Linux systems, virtualization hosts, container platforms, and network appliances where untrusted users or workloads can reach local networking control paths.

How an attack unfolds

An attacker first obtains local access to an affected Linux host with sufficient privileges or delegated capability to interact with the network datapath path involved in Open vSwitch generic netlink packet execution. The attacker then causes Bare UDP metadata destination resolution to run for an IPv6 path while the Bare UDP device socket has not been created or has already been cleared because the device is down. The vulnerable function fails to verify that the socket pointer is non-NULL and calls the IPv6 UDP tunnel destination lookup routine. That routine dereferences sock->sk through the NULL socket pointer, causing a kernel NULL pointer dereference. The practical outcome is a local denial of service through a kernel oops or full system panic, depending on host configuration.

How to fix it

Upgrade to a vendor-supported Linux kernel that includes the upstream Bare UDP fix adding a NULL check in bareudp_fill_metadata_dst() and returning -ESHUTDOWN when the device socket is unavailable. No exact fixed package versions were provided, so use the fixed kernel builds from the relevant Linux distribution, appliance vendor, cloud image provider, or kernel long-term-stable branch. Where immediate patching is not possible, reduce exposure by disabling or unloading unused Bare UDP functionality, restricting Open vSwitch and netlink administration capabilities to trusted administrators only, limiting CAP_NET_ADMIN in containers and services, avoiding delegation of network device control to untrusted users, and ensuring kernel panic-on-oops settings align with operational recovery requirements.

How to confirm the fix worked

Confirm that affected systems are running a kernel build that contains the Bare UDP NULL pointer check in bareudp_fill_metadata_dst(). Validate through vendor advisories, kernel changelogs, package metadata, or source inspection for logic that returns -ESHUTDOWN when bareudp->sock is NULL before calling udp_tunnel6_dst_lookup(). Inventory hosts for Bare UDP/Open vSwitch usage by checking loaded modules, configured Bare UDP interfaces, and Open vSwitch datapaths. After patching, reboot into the fixed kernel and confirm with uname -r and package manager records that the active kernel is the updated build. Review kernel logs to ensure no recurring NULL pointer dereference traces involving bareudp_fill_metadata_dst() or udp_tunnel6_dst_lookup() are present.

Typical attack path

1. Gain local access to an affected Linux system, or compromise a local workload/user with access to relevant networking interfaces or netlink paths.
2. Identify that Bare UDP and Open vSwitch-related kernel functionality is present and usable on the host.
3. Place or leave the Bare UDP device in a down/stopped state so its socket pointer is NULL.
4. Trigger the Open vSwitch packet execution path that calls bareudp_fill_metadata_dst() for an IPv6 metadata destination.
5. Cause udp_tunnel6_dst_lookup() to dereference the NULL socket pointer.
6. Crash the kernel path, resulting in host instability, kernel oops, or system panic.

How to detect it

To determine whether this was already exploited or triggered, review kernel logs, journal entries, console logs, hypervisor console captures, and crash dump records for NULL pointer dereferences in the Bare UDP and Open vSwitch call path. Useful sources include dmesg output, /var/log/kern.log, /var/log/messages, systemd journal kernel facility logs, kdump/vmcore analysis, crash utility backtraces, and monitoring alerts for unexpected node reboots or kernel panics. Look for the characteristic call trace containing bareudp_fill_metadata_dst(), udp_tunnel6_dst_lookup(), do_execute_actions(), ovs_execute_actions(), ovs_packet_cmd_execute(), and generic netlink receive functions. Correlate any crash timestamps with local user activity, container workloads granted CAP_NET_ADMIN, Open vSwitch control-plane events, interface state changes for Bare UDP devices, and unexpected netlink operations. Because this flaw is a denial-of-service condition, evidence is likely to be a kernel oops, panic, reboot, vmcore, or availability alert rather than file modification or outbound command-and-control traffic.

• BUG: kernel NULL pointer dereference, address: 0000000000000018
• RIP: 0010:udp_tunnel6_dst_lookup
• bareudp_fill_metadata_dst
• drivers/net/bareudp.c:532
• udp_tunnel6_dst_lookup
• net/ipv6/ip6_udp_tunnel.c:160
• do_execute_actions
• net/openvswitch/actions.c:901
• ovs_execute_actions
• ovs_packet_cmd_execute
• net/openvswitch/datapath.c:700
• genl_family_rcv_msg_doit
• genl_rcv_msg
• netlink_rcv_skb
• kernel NULL pointer dereference
• bareudp

What your security team should do

• Prioritize patching Linux hosts that run Open vSwitch, Bare UDP tunneling, container networking, virtualization networking, or network appliance functions.
• Restrict local access and network administration privileges, especially CAP_NET_ADMIN, generic netlink access, and Open vSwitch control-plane access, to trusted users and services only.
• Inventory systems for Bare UDP and Open vSwitch usage; deprioritize systems where the vulnerable functionality is not present, loaded, or reachable.
• Monitor kernel logs and crash dumps for NULL pointer dereferences involving bareudp_fill_metadata_dst(), udp_tunnel6_dst_lookup(), and ovs_packet_cmd_execute().
• Review kernel panic and crash dump settings so denial-of-service events produce useful forensic artifacts without causing unnecessary extended outages.
• Track Linux distribution and vendor advisories for exact fixed kernel package versions, because fixed versions were not provided in the input data.