Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow for network loops when redirecting traffic between interfaces. This occurs because the system fails to track the redirection state properly when packets are deferred, potentially leading to resource exhaustion or network instability. Administrators using complex traffic control (tc) configurations with 'mirred' actions are most at risk.
Technical details
A logic error in 'net/sched/act_mirred.c' within the Linux kernel allows for undetected network loops during packet redirection. When the 'mirred' action redirects a packet to an ingress interface, the loop detection state stored in the 'sched_mirred_dev' array is lost due to packet deferral into the backlog and the subsequent clearing of the array. An attacker or misconfiguration can trigger an infinite loop (e.g., ethx:ingress -> ethy:egress -> ethx:ingress), bypassing existing recursion limits. The fix introduces 'tc_depth' tracking in the socket buffer (skb) and a 'MIRRED_DEFER_LIMIT' to ensure loops are identified even when packets are deferred. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.19, 7.0.12, 7.1
Timeline
- 2026-07-19: disclosed: CVE published and NVD record created
- 2026-06-09: patched: Fixes committed to stable kernel trees