NULL pointer dereference in Linux kernel - CVE-2026-53337
Published: July 2, 2026
Vulnerability identifier: #VU136713
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53337
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in bond_do_ioctl() when handling bonding ioctl requests with a non-existent slave interface name. A local privileged user can send a bonding ioctl request referencing a non-existent slave interface to cause a denial of service.
The issue is reachable from userspace through the bonding ioctl interface.
How to mitigate CVE-2026-53337
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1b7558c85493467b2ea20738866b822db6442034
- https://git.kernel.org/stable/c/66693957bacd1c9dae6188a7312d6be69a221f2d
- https://git.kernel.org/stable/c/a629418d463fb50d132a1aa063b0105857311e5f
- https://git.kernel.org/stable/c/a764b0e8317a863006e05732e1aefe821b9d8c2d
- https://git.kernel.org/stable/c/b02b2e3e876c18733b868a29064abd11cdbf8feb
- https://git.kernel.org/stable/c/b0878106ddc486375084145848ff255dedfff46a
- https://git.kernel.org/stable/c/bcb8fad90f27300add583a8371db504b766d95c7
- https://git.kernel.org/stable/c/c2cfe290fdb1c32a4f4eb2b8ca3f363b305d21ba