Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a system crash. The issue occurs when the system attempts to redirect network traffic to multiple different types of network interfaces simultaneously. This can lead to memory corruption and a complete system failure (kernel panic), impacting the availability of the server or device.
Technical details
A logic error exists in the tcf_blockcast_redir() function within net/sched/act_mirred.c. When iterating through block ports to redirect packets to multiple devices, the code incorrectly queries the mac_header_xmit flag from the next device in the iteration instead of the current target device (dev_prev). This mismatch causes tcf_mirred_to_dev() to incorrectly push or pull MAC headers. In environments with mixed device types (e.g., veth and tunnel devices), this leads to socket buffer (skb) header corruption. Specifically, an incorrect mac_len during skb_push_rcsum can exhaust headroom, resulting in a kernel panic. Patches have been released for various stable branches including 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.8 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-04-13: other: Initial patch authored
- 2026-06-24: disclosed: CVE published