Executive brief
A vulnerability was identified in the Linux kernel's network traffic control system. This component is responsible for managing how data packets are prioritized and routed through the network. An attacker could exploit this flaw to cause a system crash (denial of service), potentially disrupting network operations and server availability.
Technical details
A NULL pointer dereference exists in the net/sched/cls_fw.c component of the Linux kernel. The vulnerability is rooted in the way Traffic Control (TC) filters are handled; specifically, filters are added to a shared block and published to the datapath before their ->change() function is invoked. This race condition allows an 'old-style' filter to attempt packet classification using an uninitialized Qdisc pointer ('q'), leading to a kernel panic when accessing 'q->handle'. The fix involves skipping 'old-style' classification on shared blocks within the fw_classify() function. The issue was introduced by changes intended to protect filter chains with mutex locks.
Affected products
- Linux Linux kernel 7.0-rc6
Timeline
- 2026-04-08: patched: Initial patch authored by Davide Caratti
- 2026-06-24: advisory: CVE-2026-53080 published
References
- https://git.kernel.org/stable/c/41845bc5bb64f3d615abe575ad655b5e7f193634
- https://git.kernel.org/stable/c/4fabcfea7a9dd159df32c5df6587fe858cb0d748
- https://git.kernel.org/stable/c/5dcce34c57d5e5990869384d69deeb9414bf9b92
- https://git.kernel.org/stable/c/5df49f0579f7e625f2358a219d31fbc7621be799
- https://git.kernel.org/stable/c/65782b2db7321d5f97c16718c4c7f6c7205a56be
- https://git.kernel.org/stable/c/829808cbf8cf8a6d07a0e67a5ea2c3fcd63a9e5c
- https://git.kernel.org/stable/c/a719275da488835e987d28effc04679b4aace3a0