[BUG] Potential Null Pointer Dereference in udp_gro_receive_segment Function

[BUG] Potential Null Pointer Dereference in udp_gro_receive_segment Function

[冯嘉仪]

Dear Maintainer,

Our team recently developed a null-pointer-dereference (NPD) vulnerability detection tool, and we used it to scan the Linux Kernel (version 6.9.6). After manual review, we identified a potentially vulnerable code snippet that could lead to a null-pointer dereference bug. We would appreciate your expert insight to confirm whether this vulnerability could indeed pose a risk to the system.

Vulnerability Description:
File:  net/ipv4/udp_offload.c
In the function udp_gro_receive_segment, we found the following line of code:

if (!uh->check) {

The issue arises because the uh pointer may be passed as NULL in certain situations. Since uh is NULL, accessing uh->check in the statement could result in a null-pointer dereference.

Proposed Fix:
To prevent the potential null-pointer dereference, we suggest adding a NULL check for the uh pointer before attempting to dereference uh->check in the line.

Request for Review:
We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system, and if the proposed fix is appropriate. If there are reasons why this issue does not present a real risk (e.g., the NULL check is redundant or unnecessary), we would be grateful for clarification.

Thank you for your time and consideration.

Re: [BUG] Potential Null Pointer Dereference in udp_gro_receive_segment Function

[Eric Dumazet]

On Sat, Feb 14, 2026 at 1:47 PM 冯嘉仪 <23210240148@m.fudan.edu.cn> wrote:
>
> Dear Maintainer,
>
> Our team recently developed a null-pointer-dereference (NPD) vulnerability detection tool, and we used it to scan the Linux Kernel (version 6.9.6). After manual review, we identified a potentially vulnerable code snippet that could lead to a null-pointer dereference bug. We would appreciate your expert insight to confirm whether this vulnerability could indeed pose a risk to the system.
>
> Vulnerability Description:
> File:  net/ipv4/udp_offload.c
> In the function udp_gro_receive_segment, we found the following line of code:
>
> if (!uh->check) {
>
> The issue arises because the uh pointer may be passed as NULL in certain situations. Since uh is NULL, accessing uh->check in the statement could result in a null-pointer dereference.
>
> Proposed Fix:
> To prevent the potential null-pointer dereference, we suggest adding a NULL check for the uh pointer before attempting to dereference uh->check in the line.
>
> Request for Review:
> We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system, and if the proposed fix is appropriate. If there are reasons why this issue does not present a real risk (e.g., the NULL check is redundant or unnecessary), we would be grateful for clarification.
>
> Thank you for your time and consideration.

This seems bogus to me, please fix your tool.

I would suggest you stop sending more reports today.