CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks
In the Linux kernel, the following vulnerability has been resolved:
net/sched: clsfw: fix NULL pointer dereference on shared blocks
The old-method path in fwclassify() calls tcfblockq() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty clsfw filter is attached to a shared block and a packet with a nonzero major skb mark is classified.
Reject the configuration in fwchange() when the old method (no TCAOPTIONS) is used on a shared block, since fwclassify()'s old-method path needs block->q which is NULL for shared blocks.
The fixed null-ptr-deref calling stack: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fwclassify (net/sched/clsfw.c:81) Call Trace: tcfclassify (./include/net/tcwrapper.h:197 net/sched/clsapi.c:1764 net/sched/clsapi.c:1860) tcrun (net/core/dev.c:4401) devqueuexmit (net/core/dev.c:4535 net/core/dev.c:4790)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31421?
CVE-2026-31421 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2026-31421?
To fix CVE-2026-31421, upgrade to the patched version of the Linux kernel as recommended by your distribution.
What is the impact of CVE-2026-31421?
CVE-2026-31421 may lead to a NULL pointer dereference, potentially causing a denial of service.
Which versions are affected by CVE-2026-31421?
CVE-2026-31421 affects various versions of the Linux kernel prior to the security fix.
Is CVE-2026-31421 exploitable remotely?
CVE-2026-31421 is not typically exploitable remotely as it primarily affects internal resources of the kernel.