Junglewise Threat Intelligence

CVE-2026-31421: Linux Kernel NULL pointer dereference in net/sched: cls_fw

CVE-2026-31421 · Severity: medium · CVSS 5.5 · Published 2026-04-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when specific network traffic filtering rules are applied to shared network blocks, leading to a system failure (NULL pointer dereference). This primarily impacts system availability, potentially causing a denial-of-service.

Technical details

A NULL pointer dereference exists in the Linux kernel's traffic control (tc) subsystem within the firewall classifier (cls_fw). The vulnerability is located in the 'old-method' code path of fw_classify(), which calls tcf_block_q() and subsequently dereferences q->handle. In configurations using shared blocks, block->q is NULL. If an empty cls_fw filter is attached to such a shared block and a packet with a non-zero major skb mark is processed, the kernel attempts to dereference the NULL pointer. The fix involves updating fw_change() to reject configurations that use the old method (lacking TCA_OPTIONS) on shared blocks.

Affected products

  • Linux Linux Kernel 4.15 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6

Timeline

  • 2026-03-30: other: Patch authored
  • 2026-04-13: disclosed: Initial disclosure date
  • 2026-04-13: advisory: CVE-2026-31421 published

References

Related threats