CVE-2026-93286 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured (dev->atalk_ptr == NULL), this leads to a NULL pointer dereference at the at->s_net access.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2)) Call Trace: <TASK> atalk_sendmsg (net/appletalk/ddp.c:1715) __sys_sendto (net/socket.c:2265 (discriminator 1)) __x64_sys_sendto (net/socket.c:2272) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Add a NULL check consistent with the other callers of atalk_find_dev_addr().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in the Linux kernel involves a critical null pointer dereference within the AppleTalk networking subsystem, specifically affecting the LocalTalk fast path implementation. The flaw resides in the function aarp_send_ddp located in net/appletalk/aarp.c. This function is responsible for handling Address Resolution Protocol (ARP) datagram delivery packets over AppleTalk networks. During execution, particularly when operating under high-performance conditions or specific network configurations involving LocalTalk interfaces, the code invokes atalk_find_dev_addr to retrieve device-specific address information. However, the implementation fails to validate whether this retrieval operation returns a valid pointer before proceeding with subsequent operations that depend on its validity.
The technical root cause of this vulnerability is an absence of defensive programming practices regarding return value validation. When the network device associated with the current socket does not have an AppleTalk interface configured, indicated by dev->atalk_ptr being NULL, the atalk_find_dev_addr function returns a null pointer. The code subsequently attempts to access members of the returned structure, specifically accessing at->s_net. Since the base pointer is null, this memory access results in a segmentation fault or kernel panic due to dereferencing address zero. This behavior was confirmed through Kernel Address Sanitizer (KASAN) reports which highlighted a null-ptr-deref within the expected range for such an error, pinpointing the exact instruction pointer location at line 552 of aarp.c.
From an operational impact perspective, this vulnerability allows for local denial-of-service attacks against systems running affected kernel versions. An unprivileged user or process with access to network sockets configured for AppleTalk communication can trigger the vulnerable code path by initiating send operations on devices lacking proper AppleTalk configuration. The resulting crash disrupts system stability and availability, potentially requiring a full reboot of the host machine. While the attack vector is local and requires specific socket configurations, it represents a significant reliability issue in environments where mixed network protocols are utilized or where legacy protocol stacks remain enabled for compatibility purposes.
This flaw aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities resulting from improper checks of function return values before use. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Local Denial of Service (T1529) by crashing system services or the kernel itself through crafted network requests. The lack of input validation regarding internal state consistency exemplifies a common class of bugs in low-level networking code where performance optimizations sometimes bypass necessary safety checks.
The resolution involves adding an explicit NULL check immediately following the call to atalk_find_dev_addr within the aarp_send_ddp function. This modification ensures that if no AppleTalk interface is configured for the device, the function returns early without attempting to access invalid memory addresses. This approach maintains consistency with other callers of atalk_find_dev_addr throughout the kernel codebase, which already implement similar defensive checks. By enforcing this validation step, the kernel prevents illegal memory accesses and preserves system integrity even when network interfaces are misconfigured or lack expected protocol support. Administrators should ensure their systems are updated to include patches addressing this specific issue in net/appletalk/aarp.c to mitigate the risk of local denial-of-service attacks via AppleTalk socket operations.