Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-31422

net/sched: cls_flow: fix NULL pointer dereference on shared blocks

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: fix NULL pointer dereference on shared blocks flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block. Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below: ======================================================================= KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] =======================================================================

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in 57f94ac7e953eece5ed4819605a18f3cdfc63dcc; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in 942813276edeb1741fa5b0a73471beb4e495fa08; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in cc707a4fd4c3b6ab2722e06bc359aa010e13d408; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in 4a09f72007201c9f667dc47f64517ec23eea65e5; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in 9bf5fc36a43f7b8b5507c96e74fb81f1e8b4957e; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in a208c3e1232997e9317887294c20008dfcb75449; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in 415ea0c973c754b9f375225807810eb9045f4293; From 1abf272022cf1d18469405f47b4ec49c6a3125db · fixed in 1a280dd4bd1d616a01d6ffe0de284c907b555504

  • Linux Linux

    4.15

  • KernelLinux

    From 4.15.0 · fixed in 5.10.253; From 5.11.0 · fixed in 5.15.203; From 5.16.0 · fixed in 6.1.168; From 6.2.0 · fixed in 6.6.134; From 6.7.0 · fixed in 6.12.81; From 6.13.0 · fixed in 6.18.22; From 6.19.0 · fixed in 6.19.12

References 8

git.kernel.org