CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks
In the Linux kernel, the following vulnerability has been resolved:
net/sched: clsflow: fix NULL pointer dereference on shared blocks
flowchange() calls tcfblockq() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block.
Check tcfblockshared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below:
======================================================================= KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flowchange (net/sched/clsflow.c:508) Call Trace: tcnewtfilter (net/sched/clsapi.c:2432) rtnetlinkrcvmsg (net/core/rtnetlink.c:6980) [...] =======================================================================
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31422?
CVE-2026-31422 is classified as a medium severity vulnerability due to its potential to cause a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2026-31422?
To fix CVE-2026-31422, update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-31422?
CVE-2026-31422 affects the Linux kernel, specifically versions that utilize the cls_flow module.
What are the potential impacts of CVE-2026-31422?
The CVE-2026-31422 vulnerability can lead to system instability by causing a NULL pointer dereference, potentially resulting in crashes.
Is there an exploit available for CVE-2026-31422?
As of now, there is no public information indicating that an exploit for CVE-2026-31422 has been developed.