CVE-2026-52925

A flaw was found in the Linux kernel's Virtual Routing and Forwarding (VRF) functionality. When a network device is removed from a VRF, a lack of proper synchronization can lead to a Null Pointer Dereference (NPD). This issue can be triggered by a local user, potentially causing the system to crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploiting this race condition requires local access during privileged network reconfiguration, resulting in a system crash without compromising confidentiality or integrity. Virtual Routing and Forwarding (VRF) domains are optional network configurations that are not active by default in standard installations. Triggering the synchronization defect demands administrative actions—specifically removing a slave interface from a VRF master—to coincide with concurrent local socket activity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.