CVE-2026-68337 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject redirect helpers without a bpf_net_context
The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task bpf_redirect_info via bpf_net_ctx_get_ri(), which dereferences the current->bpf_net_context unconditionally. That context is established on the paths that run tc BPF such as sch_handle_{ingress,egress}(),
*except* for the case where {cls,act}_bpf was attached to a proper
qdisc. A program running from there reaches the NULL deref in two ways:
* It calls bpf_redirect() directly, which dereferences the context at the top of the helper:
tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \ avpkt 1000 burst 100 qevent early_drop block 10 tc filter add block 10 pref 1 bpf obj redirect.o
* It simply returns TC_ACT_REDIRECT without helper call: tcf_qevent_handle() then dispatches to skb_do_redirect(), which dereferences the context
Rather than extending bpf_net_context management into the qdisc path, make the redirect helpers refuse to operate when no context exists, and have tcf_qevent_handle() drop a TC_ACT_REDIRECT verdict instead of calling skb_do_redirect(). Previous behaviour was a crash, so nothing regresses by not supporting it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists in the Linux kernel's eBPF implementation where the bpf_redirect*() helpers and skb_do_redirect() function fail to properly validate the existence of a bpf_net_context before dereferencing it. The issue stems from the unconditional dereference of current->bpf_net_context through bpf_net_ctx_get_ri() within these redirect operations. This context is typically established when BPF programs execute through traffic control (tc) paths such as sch_handle_ingress and sch_handle_egress, but it remains uninitialized when BPF programs are attached to qdiscs via cls_bpf or act_bpf. The vulnerability manifests when a program running in this qdisc context attempts to perform redirection either directly through bpf_redirect() helper or by returning TC_ACT_REDIRECT verdict which then triggers skb_do_redirect(). This scenario results in a NULL pointer dereference leading to kernel crashes, representing a critical security flaw that can be exploited to cause denial of service attacks. The vulnerability maps to CWE-476 Null Pointer Dereference and aligns with ATT&CK technique T1499.100 (Endpoint Denial of Service) as it allows adversaries to crash kernel components through crafted BPF programs.
The technical flaw occurs at the intersection of kernel networking subsystems where eBPF programs interact with traffic control mechanisms. When BPF programs attached to qdiscs execute redirect operations, they expect a valid bpf_net_context structure that only exists in tc-specific execution paths. The current implementation lacks proper validation checks before accessing this context structure, creating an exploitable condition where any program attempting redirection without proper context initialization will cause a kernel panic. This design flaw affects the kernel's memory management and process scheduling components since the dereference occurs at the task level through current->bpf_net_context access pattern. The vulnerability is particularly concerning because it can be triggered by legitimate network operations and does not require elevated privileges beyond the ability to load BPF programs. The issue represents a fundamental failure in kernel space validation patterns and demonstrates inadequate boundary checking in the networking subsystem's BPF integration.
The operational impact of this vulnerability extends beyond simple denial of service scenarios as it affects the stability and reliability of network processing within Linux systems. Systems running with BPF programs attached to qdiscs become vulnerable to crashes when redirection operations are attempted, potentially affecting network connectivity for all applications on the host. Attackers could exploit this by crafting malicious BPF programs that trigger the NULL dereference condition, causing kernel panics that require system reboot to recover from. The vulnerability affects network infrastructure components including routers, firewalls, and network monitoring tools that rely heavily on BPF for traffic processing. Additionally, since this impacts core networking functionality, it can cascade into broader system instability affecting other subsystems that depend on reliable network operations. The absence of proper context validation means that legitimate network management operations could unexpectedly fail or crash the kernel, creating operational challenges for system administrators and network engineers.
The recommended mitigations focus on implementing proper validation checks within the BPF redirect helper functions to verify the existence of bpf_net_context before attempting dereference operations. The solution involves modifying the bpf_redirect*() helpers to return an error code when no context exists rather than allowing NULL pointer dereference, and updating tcf_qevent_handle() to drop TC_ACT_REDIRECT verdicts instead of calling skb_do_redirect(). This approach aligns with secure programming practices and follows the principle of least privilege by ensuring that operations only proceed when all required preconditions are met. Kernel administrators should also implement proper monitoring for BPF program loading activities and restrict BPF program capabilities where possible. The fix maintains backward compatibility while preventing the crash condition, as the previous behavior was already a kernel crash scenario. Organizations should update their kernel versions to include this patch and conduct thorough testing of network applications that utilize BPF redirection features to ensure continued stable operation under normal conditions.