CVE-2026-63981: Linux Kernel Privilege Escalation Flaw

CVE-2026-63981 Overview

CVE-2026-63981 is a Linux kernel vulnerability in the net/sched subsystem, specifically within the act_mirred traffic control action. The tcf_mirred_act() function fails to increment the sched_mirred_nest recursion counter when the action uses blockcast (tcfm_blockid != 0), because the function returns at the tcf_blockcast() call before reaching the counter increment. This bypasses the MIRRED_NEST_LIMIT check and enables unbounded recursion between devices sharing a TC egress block, ultimately causing a kernel stack overflow and panic.

Critical Impact
An unprivileged local user leveraging user namespaces can trigger a kernel stack overflow, resulting in a denial-of-service condition through kernel panic.

Affected Products

Linux kernel with net/sched: act_mirred blockcast support
Systems permitting unprivileged user namespaces (unshare(CLONE_NEWUSER | CLONE_NEWNET))
Distributions shipping kernels prior to the fixing commits 25fc9352590f, 34457de389fb, and a005fa5d7502

Discovery Timeline

2026-07-19 - CVE-2026-63981 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63981

Vulnerability Analysis

The vulnerability resides in tcf_mirred_act() inside the Linux kernel traffic control (TC) action module act_mirred. The function is designed to mirror or redirect packets between network devices as part of a classifier action pipeline. To prevent unbounded recursion, the function checks a per-CPU sched_mirred_nest counter against MIRRED_NEST_LIMIT, defined as 4.

When a mirred action targets a block rather than a single device (blockcast mode), the code path takes an early return through tcf_blockcast() before the counter increment executes. The nesting counter therefore never advances, and subsequent recursive entries observe a stale value and pass the limit check unconditionally.

Root Cause

The root cause is a control flow ordering defect [CWE-674 uncontrolled recursion]. The counter increment protecting against deep recursion is placed after the blockcast branch return, so blockcast execution paths never account for their own nesting depth. The fix reorders operations to increment sched_mirred_nest before calling tcf_blockcast() and decrement on return, mirroring the non-blockcast path.

Attack Vector

The bug is reachable from an unprivileged user via unshare(CLONE_NEWUSER | CLONE_NEWNET). User namespaces grant CAP_NET_ADMIN inside the new network namespace, which is sufficient to create dummy devices, attach clsact qdiscs with shared blocks, and install mirred blockcast filters.

An attacker configures two devices, A and B, that share a TC egress block containing a mirred blockcast rule. A packet egressing on device A is mirrored to device B via blockcast. Device B's egress TC then re-enters tcf_mirred_act() via blockcast and mirrors back to A. The call chain tcf_mirred_act -> tcf_blockcast -> tcf_mirred_to_dev -> dev_queue_xmit -> sch_handle_egress -> tcf_classify -> tcf_mirred_act repeats until the kernel stack guard page is hit, producing a fatal exception and kernel panic.

Detection Methods for CVE-2026-63981

Indicators of Compromise

Kernel oops or panic messages referencing stack guard page was hit with tcf_mirred_act and tcf_mirred_to_dev repeatedly in the call trace.
Unexpected creation of dummy network interfaces and clsact qdiscs with shared blocks by non-root users.
Processes invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) followed by tc command execution or netlink RTM_NEWTFILTER messages configuring mirred blockcast actions.

Detection Strategies

Audit kernel.unprivileged_userns_clone and user.max_user_namespaces settings, then alert on unprivileged user namespace creation on systems where it is not required.
Monitor for repeated tcf_mirred_act frames in kernel crash dumps or dmesg output, which indicate exploitation attempts of this recursion bypass.
Correlate netlink traffic control configuration events with the invoking user identity to detect suspicious TC modifications from unprivileged contexts.

Monitoring Recommendations

Forward dmesg, journald, and kdump output to a central log aggregator and alert on stack guard page fault signatures.
Enable auditd rules on unshare and setns syscalls to capture namespace transitions preceding network configuration changes.
Track kernel version inventory across the fleet to prioritize systems still exposed to unpatched act_mirred code paths.

How to Mitigate CVE-2026-63981

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced by commits 25fc9352590f, 34457de389fb, and a005fa5d7502 as delivered by your distribution vendor.
Restrict unprivileged user namespace creation on systems that do not require it by setting kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0.
Inventory hosts running kernels with act_mirred blockcast support and prioritize patching multi-tenant systems and container hosts.

Patch Information

The fix increments sched_mirred_nest before calling tcf_blockcast() and decrements it on return, ensuring recursive entries observe the updated counter and are correctly limited by MIRRED_NEST_LIMIT. Patches are available in the upstream stable tree via Kernel commit 25fc9352590f, Kernel commit 34457de389fb, and Kernel commit a005fa5d7502.

Workarounds

Disable unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 on Debian/Ubuntu derivatives, or sysctl -w user.max_user_namespaces=0 on RHEL derivatives to remove the primary attack path.
Use seccomp or AppArmor/SELinux policies to block the unshare syscall for untrusted workloads and container runtimes that do not require it.
Remove or restrict the act_mirred module where TC mirred blockcast functionality is not required for production workloads.

bash

# Configuration example: disable unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w user.max_user_namespaces=0

# Persist across reboots
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-hardening.conf
echo 'user.max_user_namespaces=0' >> /etc/sysctl.d/99-hardening.conf