CVE-2026-31421

MEDIUM EPSS 1.8%
Published Apr 13, 20262mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Apr 13, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL pointer dereference on shared blocks The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty cls_fw filter is attached to a shared block and a packet with a nonzero major skb mark is classified. Reject the configuration in fw_change() when the old method (no TCA_OPTIONS) is used on a shared block, since fw_classify()'s old-method path needs block->q which is NULL for shared blocks. The fixed null-ptr-deref calling stack: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fw_classify (net/sched/cls_fw.c:81) Call Trace: tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860) tc_run (net/core/dev.c:4401) __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
1.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 13

VendorProductVersionRange
linuxlinux_kernel*≥4.15  –  <5.10.253
linuxlinux_kernel*≥5.11  –  <5.15.203
linuxlinux_kernel*≥5.16  –  <6.1.168
linuxlinux_kernel*≥6.2  –  <6.6.134
linuxlinux_kernel*≥6.7  –  <6.12.81
linuxlinux_kernel*≥6.13  –  <6.18.22
linuxlinux_kernel*≥6.19  –  <6.19.12
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/18328eff2f97d1a6adcdb6d4a0f42f2f83a31e28
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3cb055df9e8625ce699a259d8178d67b37f2b160
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3d41f9a314afa94b1c7c7c75405920123220e8cd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5cf41031922c154aa5ccda8bcdb0f5e6226582ec
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/96426c348def662b06bfdc65be3002905604927a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d6d5bd62a09650856e1e2010eb09853eba0d64e1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/faeea8bbf6e958bf3c00cb08263109661975987c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/febf64ca79a2d6540ab6e5e197fa0f4f7e84473e
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/18328eff2f97d1a6adcdb6d4a0f42f2f83a31e28
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3cb055df9e8625ce699a259d8178d67b37f2b160
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3d41f9a314afa94b1c7c7c75405920123220e8cd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5cf41031922c154aa5ccda8bcdb0f5e6226582ec
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/96426c348def662b06bfdc65be3002905604927a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d6d5bd62a09650856e1e2010eb09853eba0d64e1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/faeea8bbf6e958bf3c00cb08263109661975987c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/febf64ca79a2d6540ab6e5e197fa0f4f7e84473e
    Patch