Executive brief
A flaw in the Linux kernel's network traffic control (TC) subsystem caused redirect actions from filter rules to be silently ignored, preventing network packet redirection policies from taking effect. Additionally, a recent code change could cause the kernel to crash with a NULL pointer error when these redirect actions are attempted. This affects traffic shaping, filtering, and advanced networking configurations that rely on packet redirection.
Technical details
The vulnerability is a logic handling issue in the Linux kernel's qdisc (queuing discipline) filter chain processing. When a TC filter returns TC_ACT_REDIRECT (via eBPF's bpf_redirect() helper or act_bpf action), the qdisc classify function did not handle this action, causing the packet to be enqueued normally instead of redirected. This issue existed since bpf_redirect() was introduced for TC in 2015. A recent refactoring that moved bpf_net_context from a per-CPU variable to a task_struct member (requiring explicit setup) exposed an additional crash: bpf_redirect() now triggers a NULL pointer dereference when called without proper context initialization. The fix wraps tcf_classify() with a tcf_classify_qdisc() helper that converts unhandled TC_ACT_REDIRECT verdicts to TC_ACT_SHOT (packet drop), making packet loss visible to users rather than silently hiding the problem.
Affected products
- Linux Linux kernel since commit 27b29f63058d (2015), particularly affected by commit 401cb7dae813
Timeline
- 2026-08-12: disclosed