CVE-2026-31421

Vulnerability

CVE-2026-31421 is a NULL pointer dereference vulnerability in the Linux kernel's net/sched cls_fw classifier. The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. For shared blocks, block->q is set to NULL, leading to a NULL dereference when a packet with a nonzero major skb mark is classified through an empty cls_fw filter attached to a shared block.

Exploitation

An attacker can trigger this vulnerability by configuring a cls_fw classifier on a shared block without using the TCA_OPTIONS attribute (the old method). When a packet with a nonzero major skb mark is then processed, the fw_classify() function dereferences the NULL block->q pointer, causing a kernel crash. No authentication is needed if the attacker can configure traffic control rules, which typically requires root privileges or CAP_NET_ADMIN.

Impact

Successful exploitation causes a denial of service (DoS) via a kernel NULL pointer dereference, leading to system crash or unrecoverable state. The vulnerability does not allow privilege escalation or information disclosure; its impact is limited to system availability.

Mitigation

The Linux kernel upstream has fixed the issue by rejecting the old-method configuration in fw_change() when a shared block is used. The fix is included in stable kernel commits [1], [2], [3], [4]. Users should apply the latest stable kernel updates to remediate the vulnerability. No workaround is available for unpatched systems.