All vulnerabilities
CVE-2026-93286

Linux: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in51cc5e756cec6071ffc620076aebcf5bae936668Also 8c4b9ceb1be780588c1c50d573d5ee308e0874d2, 542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680 and 3 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 51cc5e756cec6071ffc620076aebcf5bae936668LinuxCVE List
  • 8c4b9ceb1be780588c1c50d573d5ee308e0874d2LinuxCVE List
  • 542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680LinuxCVE List
  • 8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2cLinuxCVE List
  • 83899a056aeb120898a6e3a989971fc63e274e2eLinuxCVE List
  • 9e7f36ab5b7bf68463faa5f7b926fea8f35597bbLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured (dev->atalk_ptr == NULL), this leads to a NULL pointer dereference at the at->s_net access.

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2)) Call Trace: <TASK> atalk_sendmsg (net/appletalk/ddp.c:1715) __sys_sendto (net/socket.c:2265 (discriminator 1)) __x64_sys_sendto (net/socket.c:2272) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Add a NULL check consistent with the other callers of atalk_find_dev_addr().

Text from CVE List

Affected versions 16

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 51cc5e756cec6071ffc620076aebcf5bae936668CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8c4b9ceb1be780588c1c50d573d5ee308e0874d2CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d643fd42ad96f19b5ce5cb11824fefa617191dbeCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2cCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 83899a056aeb120898a6e3a989971fc63e274e2eCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9e7f36ab5b7bf68463faa5f7b926fea8f35597bbCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.1CVE List

References 7