CVE-2026-93286

A flaw was found in the Linux kernel's AppleTalk subsystem. When transmitting network packets over a network device that lacks an AppleTalk interface configuration, the system fails to verify that interface data is initialized before accessing it. A local user can exploit this flaw by sending specific network traffic, triggering a kernel crash and resulting in a Denial of Service (DoS).

A low impact NULL pointer dereference flaw was found in the Linux kernel's AppleTalk networking subsystem. In aarp_send_ddp(), the result of atalk_find_dev_addr() is used in the LocalTalk fast path without first checking it for NULL. A local user who can send traffic on an AppleTalk socket bound to a network device that has no AppleTalk interface configured (dev->atalk_ptr == NULL) can trigger a NULL pointer dereference at the at->s_net access, causing a kernel oops/panic and resulting in a denial of service. There is no impact on confidentiality or integrity. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate), Red Hat rates the overall impact of this flaw as Low because it is limited to a local denial of service. All Red Hat Enterprise Linux 7 through 10, Red Hat In-Vehicle OS, and OpenShift Container Platform streams are not affected because the vulnerable code is not present in the shipped kernels; the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope. Upstream resolved the issue by adding a NULL check consistent with the other callers of atalk_find_dev_addr().

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.