UBUNTU-CVE-2026-68441: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT (ex: via an eBPF program calling bpfredirect() or an actbpf action), the redirect was silently lost i.e no qdisc classify function handled TCACTREDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected. This has been broken since bpfredirect() was introduced for TC in commit 27b29f63058d ("bpf: add bpfredirect() helper"). We got lucky for a long time because bpfnetcontext was a per-CPU variable that was always available. commit 401cb7dae813 ("net: Reference bpfredirectinfo via taskstruct on PREEMPTRT.") turned bpfnetcontext into a taskstruct member that is only set up by explicit callers. Without a caller setting it up, bpfredirect() itself crashes with a NULL pointer dereference in bpfnetctxgetri(). However, even with bpfnetcontext available, TCACTREDIRECT from qdisc filter chains cannot be honored without adding skbdoredirect() calls to every qdisc classify function, which would require changes across net/sched/. Isolate it to ebpf core where it belongs. Instead, add a tcfclassifyqdisc() inline helper in pktcls.h, as a wrapper around tcfclassify() for use by qdisc classify functions and tcfqeventhandle(). When the classify verdict is TCACTREDIRECT, the wrapper converts it to TCACTSHOT, dropping the packet rather than letting it continue silently. Dropping is preferred over letting the packet through because the user immediately sees packet loss. Silently passing the packet through would hide the problem and leave the user wondering why their redirect is not working. The clsact fast path, tcrun() continues to call tcfclassify() directly and is unaffected: TCACTREDIRECT is returned as-is and handled by schhandleegress/ingress() calling skbdoredirect() as before.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Which Ubuntu systems are exposed to this issue?
The affected software list includes Ubuntu linux, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants. Exposure requires use of a TC filter attached to a qdisc filter chain that returns TC_ACT_REDIRECT.
What configuration or workload is needed to trigger the problem?
A qdisc filter-chain program or action must return TC_ACT_REDIRECT, such as an eBPF program using bpf_redirect() or an act_bpf action. Without handling for that return value, the packet is enqueued normally instead of being redirected.
Can this cause a kernel crash?
On systems where bpf_net_context is not set up by an explicit caller, bpf_redirect() can dereference a NULL pointer in bpf_net_ctx_get_ri(). The description specifically notes this condition after bpf_net_context became a task_struct member for PREEMPT_RT.