CVE-2026-31421

net/sched: cls_fw: fix NULL pointer dereference on shared blocks

State: Published
Severity: Not scored
Published: Apr 13, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_fw: fix NULL pointer dereference on shared blocks

The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty cls_fw filter is attached to a shared block and a packet with a nonzero major skb mark is classified.

Reject the configuration in fw_change() when the old method (no TCA_OPTIONS) is used on a shared block, since fw_classify()'s old-method path needs block->q which is NULL for shared blocks.

The fixed null-ptr-deref calling stack: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fw_classify (net/sched/cls_fw.c:81) Call Trace: tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860) tc_run (net/core/dev.c:4401) __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1abf272022cf1d18469405f47b4ec49c6a3125db to before d6d5bd62a09650856e1e2010eb09853eba0d64e1Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before febf64ca79a2d6540ab6e5e197fa0f4f7e84473eAffected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 3d41f9a314afa94b1c7c7c75405920123220e8cdAffected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 18328eff2f97d1a6adcdb6d4a0f42f2f83a31e28Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 5cf41031922c154aa5ccda8bcdb0f5e6226582ecAffected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 3cb055df9e8625ce699a259d8178d67b37f2b160Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 96426c348def662b06bfdc65be3002905604927aAffected 1abf272022cf1d18469405f47b4ec49c6a3125db to before faeea8bbf6e958bf3c00cb08263109661975987cAffected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

1abf272022cf1d18469405f47b4ec49c6a3125db to before d6d5bd62a09650856e1e2010eb09853eba0d64e1Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before febf64ca79a2d6540ab6e5e197fa0f4f7e84473eAffected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 3d41f9a314afa94b1c7c7c75405920123220e8cdAffected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 18328eff2f97d1a6adcdb6d4a0f42f2f83a31e28Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 5cf41031922c154aa5ccda8bcdb0f5e6226582ecAffected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 3cb055df9e8625ce699a259d8178d67b37f2b160Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 96426c348def662b06bfdc65be3002905604927aAffected
1abf272022cf1d18469405f47b4ec49c6a3125db to before faeea8bbf6e958bf3c00cb08263109661975987cAffected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.