Junglewise Threat Intelligence

CVE-2026-53080: Linux kernel NULL pointer dereference in cls_fw classifier

CVE-2026-53080 · Severity: info · CVSS 5.5 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's network traffic control system. This component is responsible for managing how data packets are prioritized and routed through the network. An attacker could exploit this flaw to cause a system crash (denial of service), potentially disrupting network operations and server availability.

Technical details

A NULL pointer dereference exists in the net/sched/cls_fw.c component of the Linux kernel. The vulnerability is rooted in the way Traffic Control (TC) filters are handled; specifically, filters are added to a shared block and published to the datapath before their ->change() function is invoked. This race condition allows an 'old-style' filter to attempt packet classification using an uninitialized Qdisc pointer ('q'), leading to a kernel panic when accessing 'q->handle'. The fix involves skipping 'old-style' classification on shared blocks within the fw_classify() function. The issue was introduced by changes intended to protect filter chains with mutex locks.

Affected products

  • Linux Linux kernel 7.0-rc6

Timeline

  • 2026-04-08: patched: Initial patch authored by Davide Caratti
  • 2026-06-24: advisory: CVE-2026-53080 published

References

Related threats