UBUNTU-CVE-2026-68337: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect() helpers and skbdoredirect() obtain the per-task bpfredirectinfo via bpfnetctxgetri(), which dereferences the current->bpfnetcontext unconditionally. That context is established on the paths that run tc BPF such as schhandle{ingress,egress}(), except for the case where {cls,act}bpf was attached to a proper qdisc. A program running from there reaches the NULL deref in two ways: It calls bpfredirect() directly, which dereferences the context at the top of the helper: tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \ avpkt 1000 burst 100 qevent earlydrop block 10 tc filter add block 10 pref 1 bpf obj redirect.o It simply returns TCACTREDIRECT without helper call: tcfqeventhandle() then dispatches to skbdoredirect(), which dereferences the context Rather than extending bpfnetcontext management into the qdisc path, make the redirect helpers refuse to operate when no context exists, and have tcfqeventhandle() drop a TCACTREDIRECT verdict instead of calling skbdoredirect(). Previous behaviour was a crash, so nothing regresses by not supporting it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Modify the kernel so bpf_redirect*() helpers refuse to operate when no bpf_net_context exists, and have tcf_qevent_handle() drop a TC_ACT_REDIRECT verdict instead of calling skb_do_redirect().
Event History
Frequently Asked Questions
Which deployments are exposed to the crash condition?
Exposure requires a tc BPF program attached through cls_bpf or act_bpf to a proper qdisc. The affected program must either call a bpf_redirect*() helper or return TC_ACT_REDIRECT.
What level of access does an attacker need?
The provided severity vector identifies this as locally exploitable with low privileges and no user interaction. The described trigger requires reaching a vulnerable tc BPF program path.
What is the impact of successful triggering?
The redirect path can dereference current->bpf_net_context when it is NULL. The supplied vector rates availability impact as high, with no confidentiality or integrity impact indicated.
What can be done before an update is available?
Avoid attaching cls_bpf or act_bpf programs to a qdisc when those programs use bpf_redirect*() or return TC_ACT_REDIRECT. Removing or changing those redirect paths prevents the two described NULL-dereference triggers.
How can I identify relevant configurations?
Review tc qdisc and filter configuration for BPF programs attached to qdiscs, including cls_bpf or act_bpf attachments. Inspect those programs for calls to bpf_redirect*() and for TC_ACT_REDIRECT return values.