CVE-2026-45846

In the Linux kernel, the following vulnerability has been resolved:

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

bareudp_fill_metadata_dst() passes bareudp->sock to

udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check.

The socket is only created in bareudp_open() and NULLed in

bareudp_stop(), so calling this function while the device is down

triggers a NULL dereference via sock->sk.

BUG: kernel NULL pointer dereference, address: 0000000000000018

RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160)

Call Trace:

<TASK>

bareudp_fill_metadata_dst (drivers/net/bareudp.c:532)

do_execute_actions (net/openvswitch/actions.c:901)

ovs_execute_actions (net/openvswitch/actions.c:1589)

ovs_packet_cmd_execute (net/openvswitch/datapath.c:700)

genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)

genl_rcv_msg (net/netlink/genetlink.c:1209)

netlink_rcv_skb (net/netlink/af_netlink.c:2550)

</TASK>

Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths

in the same driver.