CVE-2026-53069

A flaw was found in the Linux kernel's networking subsystem. This vulnerability, a null-pointer dereference, occurs in the XDP (eXpress Data Path) redirect mechanism when processing network traffic on a bonding device that has not been fully initialized. An attacker could potentially trigger this condition, leading to a kernel panic and causing a Denial of Service (DoS) on the system.

This vulnerability is rated as Moderate severity because triggering the crash requires local administrative privileges (such as CAP_NET_ADMIN) to load and bind native eBPF programs across network interfaces. In standard Red Hat Enterprise Linux deployments, unprivileged users cannot configure network devices or attach eXpress Data Path programs. While a successful exploit results in an immediate denial of service through an operating system crash, it does not allow confidentiality loss or unauthorized privilege escalation. Earlier platforms such as Red Hat Enterprise Linux 8 are not vulnerable because the underlying redirect infrastructure is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.