CVE-2026-93286

net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

State: Published
Severity: Not scored
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: appletalk: fix NULL pointer dereference in aarp_send_ddp()

aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured (dev->atalk_ptr == NULL), this leads to a NULL pointer dereference at the at->s_net access.

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2)) Call Trace: <TASK> atalk_sendmsg (net/appletalk/ddp.c:1715) __sys_sendto (net/socket.c:2265 (discriminator 1)) __x64_sys_sendto (net/socket.c:2272) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Add a NULL check consistent with the other callers of atalk_find_dev_addr().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 51cc5e756cec6071ffc620076aebcf5bae936668Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c4b9ceb1be780588c1c50d573d5ee308e0874d2Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d643fd42ad96f19b5ce5cb11824fefa617191dbeAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 83899a056aeb120898a6e3a989971fc63e274e2eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9e7f36ab5b7bf68463faa5f7b926fea8f35597bbAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 51cc5e756cec6071ffc620076aebcf5bae936668Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c4b9ceb1be780588c1c50d573d5ee308e0874d2Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d643fd42ad96f19b5ce5cb11824fefa617191dbeAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 83899a056aeb120898a6e3a989971fc63e274e2eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9e7f36ab5b7bf68463faa5f7b926fea8f35597bbAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.