CVE-2026-22987: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actapi: avoid dereferencing ERRPTR in tcfidrinfodestroy
syzbot reported a crash in tcactinhw() during netns teardown where tcfidrinfodestroy() passed an ERRPTR(-EBUSY) value as a tcaction pointer, leading to an invalid dereference.
Guard against ERRPTR entries when iterating the action IDR so teardown does not call tcactinhw() on an error pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
When iterating the action IDR during teardown in tcf_idrinfo_destroy(), guard against ERR_PTR entries and do not call tc_act_in_hw() on an error pointer such as ERR_PTR(-EBUSY).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22987?
CVE-2026-22987 is a vulnerability in the Linux kernel that has been reported to cause a crash during network namespace teardown.
How do I fix CVE-2026-22987?
To fix CVE-2026-22987, it is recommended to update to the latest stable version of the Linux kernel where this vulnerability has been patched.
What systems are affected by CVE-2026-22987?
CVE-2026-22987 affects the Linux kernel, specifically impacting systems that utilize the traffic control (tc) mechanism.
Is CVE-2026-22987 an exploitable vulnerability?
CVE-2026-22987 is primarily considered a denial-of-service vulnerability due to its nature of causing a system crash.
Where can I find more information about CVE-2026-22987?
Additional information about CVE-2026-22987 can be found in the kernel changelogs or security advisories related to the Linux kernel.