CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Handle TCACTREDIRECT from qdisc filter chains
When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT (ex: via an eBPF program calling bpfredirect() or an actbpf action), the redirect was silently lost i.e no qdisc classify function handled TCACTREDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected.
This has been broken since bpfredirect() was introduced for TC in commit 27b29f63058d ("bpf: add bpfredirect() helper"). We got lucky for a long time because bpfnetcontext was a per-CPU variable that was always available.
commit 401cb7dae813 ("net: Reference bpfredirectinfo via taskstruct on PREEMPTRT.") turned bpfnetcontext into a taskstruct member that is only set up by explicit callers. Without a caller setting it up, bpfredirect() itself crashes with a NULL pointer dereference in bpfnetctxgetri(). However, even with bpfnetcontext available, TCACTREDIRECT from qdisc filter chains cannot be honored without adding skbdoredirect() calls to every qdisc classify function, which would require changes across net/sched/. Isolate it to ebpf core where it belongs.
Instead, add a tcfclassifyqdisc() inline helper in pktcls.h, as a wrapper around tcfclassify() for use by qdisc classify functions and tcfqeventhandle(). When the classify verdict is TCACTREDIRECT, the wrapper converts it to TCACTSHOT, dropping the packet rather than letting it continue silently. Dropping is preferred over letting the packet through because the user immediately sees packet loss. Silently passing the packet through would hide the problem and leave the user wondering why their redirect is not working.
The clsact fast path, tcrun() continues to call tcfclassify() directly and is unaffected: TCACTREDIRECT is returned as-is and handled by schhandleegress/ingress() calling skbdoredirect() as before.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68441?
CVE-2026-68441 has a risk score of 23, indicating a critical vulnerability.
How does CVE-2026-68441 affect the Linux kernel?
CVE-2026-68441 affects the Linux kernel by improperly handling TC_ACT_REDIRECT from qdisc filter chains, leading to potential vulnerabilities.
What can be exploited in CVE-2026-68441?
The vulnerability in CVE-2026-68441 can be exploited through eBPF programs or act_bpf actions that utilize TC filter mechanisms.
How do I fix CVE-2026-68441?
To fix CVE-2026-68441, you should update your Linux kernel to the latest patched version provided by your distribution.
What is the impact of CVE-2026-68441 on network security?
CVE-2026-68441 could potentially lead to denial-of-service conditions or unintentional data exposure due to improper handling in networking components.