CVE-2026-31422

net/sched: cls_flow: fix NULL pointer dereference on shared blocks

State: Published
Severity: Not scored
Published: Apr 13, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_flow: fix NULL pointer dereference on shared blocks

flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block.

Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below:

======================================================================= KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] =======================================================================

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1abf272022cf1d18469405f47b4ec49c6a3125db to before 57f94ac7e953eece5ed4819605a18f3cdfc63dccAffected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 942813276edeb1741fa5b0a73471beb4e495fa08Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before cc707a4fd4c3b6ab2722e06bc359aa010e13d408Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 4a09f72007201c9f667dc47f64517ec23eea65e5Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 9bf5fc36a43f7b8b5507c96e74fb81f1e8b4957eAffected 1abf272022cf1d18469405f47b4ec49c6a3125db to before a208c3e1232997e9317887294c20008dfcb75449Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 415ea0c973c754b9f375225807810eb9045f4293Affected 1abf272022cf1d18469405f47b4ec49c6a3125db to before 1a280dd4bd1d616a01d6ffe0de284c907b555504Affected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

1abf272022cf1d18469405f47b4ec49c6a3125db to before 57f94ac7e953eece5ed4819605a18f3cdfc63dccAffected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 942813276edeb1741fa5b0a73471beb4e495fa08Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before cc707a4fd4c3b6ab2722e06bc359aa010e13d408Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 4a09f72007201c9f667dc47f64517ec23eea65e5Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 9bf5fc36a43f7b8b5507c96e74fb81f1e8b4957eAffected
1abf272022cf1d18469405f47b4ec49c6a3125db to before a208c3e1232997e9317887294c20008dfcb75449Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 415ea0c973c754b9f375225807810eb9045f4293Affected
1abf272022cf1d18469405f47b4ec49c6a3125db to before 1a280dd4bd1d616a01d6ffe0de284c907b555504Affected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.