The Linux kernel's xdp_master_redirect() function dereferences the result of netdev_master_upper_dev_get_rcu() without verifying if it is NULL. This helper returns NULL when the receiving device lacks an upper-master adjacency. The existing guard only checks if the device is a bond slave, but during bond slave release, the upper-master adjacency is removed before clearing the IFF_SLAVE flag. As a result, xdp_master_redirect() may access a NULL master pointer, causing a kernel NULL pointer dereference and kernel panic. The vulnerability dates back to the original code and was introduced when a master->flags read was added without a preceding NULL check. The fix involves adding a NULL check for the master pointer and treating a NULL master as equivalent to one that is not up.

This vulnerability can cause a kernel NULL pointer dereference leading to a kernel panic and denial of service on affected Linux systems. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configurations that trigger bond slave release conditions that could lead to this issue. Monitor vendor channels for updates and apply patches promptly once released.