CVE-2026-68337
NoneCVSS
—
EPSS
0.2%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel can cause the whole system to crash when certain network redirect programs run in an unusual setup, leading to unexpected downtime.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
NULL pointer dereference in bpf_redirect* helpers and skb_do_redirect when bpf_net_context is absent, triggered by direct bpf_redirect calls or TC_ACT_REDIRECT returns from cls_bpf/act_bpf attached to a qdisc instead of standard tc paths.
Why it matters to the business
Kernel crash causing system instability or denial of service on hosts running custom qdisc-based BPF redirect programs; low exploit likelihood reduces immediate risk but still requires attention for stability.
How an attack unfolds
An attacker loads a malicious BPF program via cls_bpf or act_bpf on a qdisc, either invoking bpf_redirect directly or returning TC_ACT_REDIRECT; the missing context leads to unconditional NULL dereference and crash. No named threat actors or ransomware use reported.
How to fix it
Upgrade to a kernel containing the fix that makes redirect helpers refuse operation without context and converts TC_ACT_REDIRECT to a drop in tcf_qevent_handle; apply all available stable updates promptly given 76 days since publication.
How to confirm the fix worked
Verify kernel source or binary contains the bpf_net_ctx_get_ri guard and tcf_qevent_handle drop logic; test attachment of redirect programs to qdiscs and confirm no crash occurs.
Typical attack path
- Identify or create a qdisc attachment point for cls_bpf or act_bpf
- Load a BPF program that performs bpf_redirect or returns TC_ACT_REDIRECT
- Trigger packet processing through the qdisc to reach the redirect path
- Cause NULL dereference and kernel panic
How to detect it
Search kernel logs and crash dumps for oops traces mentioning bpf_redirect, skb_do_redirect, bpf_net_context, or tcf_qevent_handle; review audit logs for recent BPF program loads on qdiscs.
- bpf_net_ctx_get_ri
- skb_do_redirect
- tcf_qevent_handle
What your security team should do
- Patch affected kernels to the fixed version as highest priority
- Audit existing tc qdisc BPF attachments for redirect usage
- Monitor for kernel oops or panic events involving bpf redirect paths
- Limit untrusted BPF program loading until patched
The record
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpf_net_context The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task bpf_redirect_info via bpf_net_ctx_get_ri(), which dereferences the current->bpf_net_context unconditionally. That context is established on the paths that run tc BPF such as sch_handle_{ingress,egress}(), *except* for the case where {cls,act}_bpf was attached to a proper qdisc. A program running from there reaches the NULL deref in two ways: * It calls bpf_redirect() directly, which dereferences the context at the top of the helper: tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \ avpkt 1000 burst 100 qevent early_drop block 10 tc filter add block 10 pref 1 bpf obj redirect.o * It simply returns TC_ACT_REDIRECT without helper call: tcf_qevent_handle() then dispatches to skb_do_redirect(), which dereferences the context Rather than extending bpf_net_context management into the qdisc path, make the redirect helpers refuse to operate when no context exists, and have tcf_qevent_handle() drop a TC_ACT_REDIRECT verdict instead of calling skb_do_redirect(). Previous behaviour was a crash, so nothing regresses by not supporting it.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|