CVE-2026-31422
Null Pointer Dereference in Linux Kernel net/sched cls_flow
Publication date: 2026-04-13
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's network scheduler component, specifically in the cls_flow module. The issue arises because the function flow_change() calls tcf_block_q() and dereferences q->handle to get a default baseclass. However, when dealing with shared blocks, block->q is NULL, which leads to a NULL pointer dereference if a flow filter without a fully qualified baseclass is created on such a shared block.
The fix involves checking if the block is shared using tcf_block_shared() before accessing block->q, and returning an error (-EINVAL) for shared blocks to avoid the NULL pointer dereference.
How can this vulnerability impact me? :
This vulnerability can cause a NULL pointer dereference in the Linux kernel, which may lead to a kernel crash or denial of service (DoS). Such a crash could disrupt network traffic handling and potentially affect system stability or availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes a NULL pointer dereference in the Linux kernel's traffic control flow classifier (cls_flow) when handling shared blocks without a fully qualified baseclass.
Detection can be done by monitoring kernel logs for messages indicating a NULL pointer dereference related to flow_change in net/sched/cls_flow.c, such as KASAN reports showing null-ptr-deref at flow_change.
You can check kernel logs using commands like:
- dmesg | grep -i 'null-ptr-deref'
- journalctl -k | grep -i 'flow_change'
- journalctl -k | grep -i 'cls_flow'
Additionally, monitoring for crashes or kernel oops related to net/sched or rtnetlink components may help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by checking for shared blocks before dereferencing pointers in the flow classifier code, avoiding NULL pointer dereferences.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- Avoid creating flow filters without fully qualified baseclasses on shared blocks until the patch is applied.
- Monitor kernel logs for signs of crashes or NULL pointer dereferences related to cls_flow and take appropriate action.