Executive brief
The Linux kernel's network scheduler contains a vulnerability in the act_ife (Intermediate Functional Element) module, which is used for encapsulating and decapsulating Ethernet headers in network packets. When processing packets from non-Ethernet devices (such as PPP connections) that are redirected to Ethernet devices, the module can perform incorrect memory operations, causing a kernel panic and denial of service. This affects systems using Linux traffic control rules to redirect or filter network traffic.
Technical details
The vulnerability is a logic error in net/sched/act_ife.c where the module uses skb->dev->hard_header_len to determine the length of the L2 header to push/pull, but this value is only accurate for Ethernet devices. On non-Ethernet devices like PPP, the actual header size differs, causing out-of-bounds memory operations (skb_under_panic). The attack vector requires the ability to configure traffic control (tc) rules that redirect packets from a non-Ethernet interface (e.g., ppp0) to an Ethernet interface (e.g., veth) with an IFE encode action. The fix validates that packets have proper Ethernet framing (checking both skb->dev->type and mac_len) before processing, and uses ETH_HLEN instead of hard_header_len. This is a kernel-level privilege escalation/DoS issue that requires CAP_NET_ADMIN to trigger.
Affected products
- Linux Linux kernel affected versions unknown; fix available
Timeline
- 2026-09-17: disclosed