NULL pointer dereference in Linux kernel - CVE-2026-63990
Published: July 20, 2026
Vulnerability identifier: #VU138662
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63990
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null-pointer dereference in the bonding driver when enslaving a CAN device to a bonding master. A local user can enslave a virtual CAN device to a bonding master to cause a denial of service.
The issue can be triggered with a virtual CAN device such as vxcan, and subsequent socket cleanup operations may access invalid CAN receiver state.
How to mitigate CVE-2026-63990
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8
- https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602
- https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb
- https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38
- https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d
- https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707
- https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893