CVE-2026-68337
Received Received - Intake

Null Pointer Dereference in Linux Kernel BPF Redirect Helpers

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpf_net_context The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task bpf_redirect_info via bpf_net_ctx_get_ri(), which dereferences the current->bpf_net_context unconditionally. That context is established on the paths that run tc BPF such as sch_handle_{ingress,egress}(), *except* for the case where {cls,act}_bpf was attached to a proper qdisc. A program running from there reaches the NULL deref in two ways: * It calls bpf_redirect() directly, which dereferences the context at the top of the helper: tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \ avpkt 1000 burst 100 qevent early_drop block 10 tc filter add block 10 pref 1 bpf obj redirect.o * It simply returns TC_ACT_REDIRECT without helper call: tcf_qevent_handle() then dispatches to skb_do_redirect(), which dereferences the context Rather than extending bpf_net_context management into the qdisc path, make the redirect helpers refuse to operate when no context exists, and have tcf_qevent_handle() drop a TC_ACT_REDIRECT verdict instead of calling skb_do_redirect(). Previous behaviour was a crash, so nothing regresses by not supporting it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68337
EUVD
EUVD-2026-55438

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference in the bpf_redirect() and skb_do_redirect() functions. These functions rely on a per-task context called bpf_net_context, which is not always properly set up when BPF programs run from certain qdisc (queueing discipline) paths. Without this context, the functions crash when attempting to access it.

Detection Guidance

This vulnerability can be detected by checking for crashes or NULL pointer dereference errors in kernel logs when BPF redirect helpers are used without a proper bpf_net_context. Look for kernel oops or panic messages related to BPF or tc (traffic control) operations.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when a BPF program running from a specific qdisc path attempts to use redirect operations. This could lead to denial of service for the affected system.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Avoid using BPF redirect helpers in qdisc paths where bpf_net_context is not established. Review and update BPF programs using redirect helpers to ensure they operate within supported contexts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart