Riskcovery

CVE-2026-22987

net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy

State
Published
Severity
Not scored
Published
Jan 23, 2026
Updated
May 11, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy

syzbot reported a crash in tc_act_in_hw() during netns teardown where tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action pointer, leading to an invalid dereference.

Guard against ERR_PTR entries when iterating the action IDR so teardown does not call tc_act_in_hw() on an error pointer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 84a7d6797e6a03705e6b48c613fa424662049d87 to before 67550a1130b647bb0d093c9c0a810c69aa6a30a8Affected
  • 84a7d6797e6a03705e6b48c613fa424662049d87 to before adb25a46dc0a43173f5ea5f5f58fc8ba28970c7cAffected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.6 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.