What is CVE-2026-45918?

CVE-2026-45918 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a NULL Pointer Dereference flaw (CWE-476), affecting Linux kernel versions from 6.16 onward and patched in 6.18.14, 6.19.4 and 7.0. CVE-2026-45918 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-45918?

CVE-2026-45918 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-45918?

Yes, CVE-2026-45918 has been patched. Fixed versions include 6.18.14, 6.19.4 and 7.0. If you are running Linux kernel 6.16 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-45918 actively exploited?

CVE-2026-45918 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is NULL Pointer Dereference (CWE-476)?

The product dereferences a pointer that it expects to be valid but is NULL, typically causing a crash. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/476.html

CVE-2026-45918

Medium

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - don't deref NULL sk_socket member after tcp_close() When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted in a "release list" for further processing. This happens in: ovpn_peer_keepalive_work() unlock_ovpn(release_list) This processing includes detaching from the socket being used to talk to this peer, by restoring its original proto and socket ops/callbacks. In case of TCP it may happen that, while the peer is sitting in the release list, userspace decides to close the socket. This will result in a concurrent execution of: tcp_close(sk) __tcp_close(sk) sock_orphan(sk) sk_set_socket(sk, NULL) The last function call will set sk->sk_socket to NULL. When the releasing routine is resumed, ovpn_tcp_socket_detach() will attempt to dereference sk->sk_socket to restore its original ops member. This operation will crash due to sk->sk_socket being NULL. Fix this race condition by testing-and-accessing sk->sk_socket atomically under sk->sk_callback_lock.

Package Linux Kernel

Published 2026-05-27

Last modified 2026-06-24

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-476

CVE-2026-45918 is a NULL Pointer Dereference vulnerability

What is NULL Pointer Dereference?

The product dereferences a pointer that it expects to be valid but is NULL, typically causing a crash. Learn more on MITRE CWE

Affected versions

Linux kernel versions 6.16 and later are affected. Fixed in 6.18.14, 6.19.4, 7.0 and their respective stable series.

Affected from

≥ 6.16

Fixed in

✓ 6.18.14 6.18.x ✓ 6.19.4 6.19.x ✓ 7.0

References

3 total

Kernel Git
https://git.kernel.org/stable/c/94560267d6c41b1ff3fafbab726e3f8a55a6af34

Patch
Kernel Git
https://git.kernel.org/stable/c/b9142cf4e066c825ec68752a7dcaceda700bbe26

Patch
Kernel Git
https://git.kernel.org/stable/c/f998b2c4bec487063a586695159f9a1856e81c56

Patch

Details

CVE ID CVE-2026-45918

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-05-27

Modified 2026-06-24

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-45918?

CVE-2026-45918 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a NULL Pointer Dereference flaw (CWE-476) . It affects Linux kernel versions from 6.16 onward and has been patched in 6.18.14, 6.19.4 and 7.0. CVE-2026-45918 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-45918?

CVE-2026-45918 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-45918?

Yes. CVE-2026-45918 has been patched. Fixed versions include 6.18.14, 6.19.4 and 7.0. If you are running Linux kernel 6.16 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-45918 actively exploited?

No. CVE-2026-45918 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.