Executive brief
The Linux kernel's traffic control (tc) classifier u32 module contains a memory safety bug where a type confusion between two internal data structures causes reads beyond allocated memory boundaries. When a system administrator configures certain network traffic filtering rules, the kernel may read from uninitialized memory, potentially exposing sensitive kernel data or triggering a kernel panic.
Technical details
A slab-out-of-bounds read vulnerability exists in net/sched/cls_u32.c where u32_bind_class() unconditionally casts an opaque function handle (fh) to struct tc_u_knode and accesses its tcf_result member. The u32_walk() callback passes both struct tc_u_hnode and struct tc_u_knode handles, but tc_u_hnode lacks a tcf_result field, causing an out-of-bounds read when fh points to a hash table node. The vulnerability is triggered via netlink-based tc commands and requires local network administrator privileges. An attacker can exploit this using crafted tc qdisc/class/filter commands to read adjacent kernel memory (e.g., res->classid access). The fix adds a TC_U32_KEY(handle) check to skip hash table nodes before accessing the tcf_result member.
Affected products
- Linux Linux Kernel All versions with net/sched/cls_u32.c (approximately 2.6.11 and later, up to and including 6.x prior to patched versions)
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched: Upstream fix committed as 6d3724e616faf952c3adcf8414fc21a828ef3709