CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actife: avoid possible NULL deref
tcfifeencode() must make sure ifeencode() does not return NULL.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ifetlvmetaencode+0x41/0xa0 net/ife/ife.c:166 CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> ifeencodemetau32+0x153/0x180 net/sched/actife.c:101 tcfifeencode net/sched/actife.c:841 [inline] tcfifeact+0x1022/0x1de0 net/sched/actife.c:877 tcact include/net/tcwrapper.h:130 [inline] tcfactionexec+0x1c0/0xa20 net/sched/actapi.c:1152 tcfextsexec include/net/pktcls.h:349 [inline] mallclassify+0x1a0/0x2a0 net/sched/clsmatchall.c:42 tcclassify include/net/tcwrapper.h:197 [inline] tcfclassify net/sched/clsapi.c:1764 [inline] tcfclassify+0x7f2/0x1380 net/sched/clsapi.c:1860 multiqclassify net/sched/schmultiq.c:39 [inline] multiqenqueue+0xe0/0x510 net/sched/schmultiq.c:66 devqdiscenqueue+0x45/0x250 net/core/dev.c:4147 devxmitskb net/core/dev.c:4262 [inline] devqueuexmit+0x2998/0x46c0 net/core/dev.c:4798
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23064?
CVE-2026-23064 has been assessed with a severity rating that could lead to a general protection fault due to a potential NULL dereference.
How do I fix CVE-2026-23064?
To address CVE-2026-23064, it is recommended to update the Linux kernel to the latest stable version where the vulnerability has been resolved.
What are the potential impacts of CVE-2026-23064 on my system?
The potential impacts of CVE-2026-23064 include unexpected crashes and system instability due to the NULL dereference issue.
Which versions of the Linux Kernel are affected by CVE-2026-23064?
CVE-2026-23064 affects certain versions of the Linux Kernel prior to the patch release addressing the vulnerability.
How was CVE-2026-23064 discovered?
CVE-2026-23064 was discovered through syzbot, which reported a general protection fault likely caused by a NULL dereference.