Kuniyuki IwashimaandGreg Kroah-Hartman 9c58c729d3 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). ...

[ Upstream commit 30a45c0bff ]

udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.

Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().

Fixes: 5602c48cf8 ("vxlan: change vxlan to use UDP socket GRO")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260502031401.3557229-7-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-07-24 15:54:33 +02:00

..

appletalk

…

arcnet

…

bonding

net: bonding: fix NULL pointer dereference in bond_do_ioctl()

2026-06-19 13:37:16 +02:00

caif

…

can

can: ucan: fix devres lifetime

2026-06-01 17:38:50 +02:00

dsa

net: dsa: mt7530: preserve VLAN tags on trapped link-local frames

2026-06-01 17:39:42 +02:00

ethernet

net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

2026-07-04 13:41:28 +02:00

fddi

…

fjes

…

hamradio

net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf

2026-06-01 17:39:08 +02:00

hippi

…

hyperv

hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

2026-06-19 13:37:29 +02:00

ieee802154

…

ipa

…

ipvlan

…

mctp

net: mctp i2c: check length before marking flow active

2026-06-01 17:39:28 +02:00

mdio

…

netdevsim

netdevsim: zero initialize struct iphdr in dummy sk_buff

2026-06-01 17:39:27 +02:00

pcs

…

phy

phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X

2026-06-19 13:36:58 +02:00

plip

…

ppp

pppoe: drop PFC frames

2026-06-01 17:39:24 +02:00

pse-pd

…

slip

slip: bound decode() reads against the compressed packet length

2026-06-01 17:39:25 +02:00

team

…

usb

net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

2026-07-24 15:54:25 +02:00

vmxnet3

…

vxlan

vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

2026-07-24 15:54:33 +02:00

wan

hdlc_ppp: sync per-proto timers before freeing hdlc state

2026-07-04 13:41:31 +02:00

wireguard

wireguard: send: append trailer after expanding head

2026-06-19 13:37:00 +02:00

wireless

wifi: ath9k: fix OOB access from firmware tx status queue ID

2026-07-24 15:54:33 +02:00

wwan

net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler

2026-06-19 13:37:23 +02:00

xen-netback

…

amt.c

…

bareudp.c

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

2026-06-01 17:39:29 +02:00

dummy.c

…

eql.c

…

geneve.c

rtnetlink: pass netlink message header and portid to rtnl_configure_link()

2026-04-11 14:16:06 +02:00

gtp.c

…

ifb.c

net: ifb: report ethtool stats over num_tx_queues

2026-06-01 17:39:35 +02:00

Kconfig

…

LICENSE.SRC

…

loopback.c

…

macsec.c

macsec: fix replay protection at XPN lower-PN wrap

2026-06-19 13:37:01 +02:00

macvlan.c

macvlan: annotate data-races around port->bc_queue_len_used

2026-06-01 17:39:06 +02:00

macvtap.c

…

Makefile

…

mdio.c

…

mhi_net.c

…

mii.c

…

net_failover.c

…

netconsole.c

netconsole: avoid out-of-bounds access on empty string in trim_newline()

2026-06-01 17:39:31 +02:00

nlmon.c

…

ntb_netdev.c

…

rionet.c

…

sb1000.c

…

Space.c

…

sungem_phy.c

…

tap.c

tap: free page on error paths in tap_get_user_xdp()

2026-06-19 13:37:10 +02:00

thunderbolt.c

…

tun.c

tun: free page on build_skb failure in tun_xdp_one()

2026-06-19 13:36:53 +02:00

veth.c

rtnetlink: pass netlink message header and portid to rtnl_configure_link()

2026-04-11 14:16:06 +02:00

virtio_net.c

virtio_net: Support dynamic rss indirection table size

2026-07-24 15:54:18 +02:00

vrf.c

vrf: Fix a potential NPD when removing a port from a VRF

2026-06-01 17:39:28 +02:00

vsockmon.c

…

xen-netfront.c

…