Executive brief
A race condition in the Linux kernel's traffic classification (flower) module allows concurrent access to filters during initialization, causing system crashes. This affects network packet processing and could lead to denial of service on systems using advanced network traffic control features.
Technical details
The vulnerability is a race condition (CWE-362) in the Linux kernel's net/sched flower classifier. An earlier commit moved IDR (ID Radix tree) initialization too early in fl_change(), allowing concurrent threads to access a filter object while it is still in an inconsistent initialization state. This can trigger a NULL pointer dereference in fl_dump_key(). The attack vector is local and requires network namespace access or root privileges to trigger filter operations. The fix inserts a NULL pointer into the IDR early to allocate a handle while preventing concurrent access until initialization completes.
Affected products
- Linux Linux Kernel 6.3-rc4 and likely earlier versions
Timeline
- 2025-12-30: disclosed