CVE-2026-63982: Linux Kernel Mirred Loop DoS Vulnerability

CVE-2026-63982 Overview

CVE-2026-63982 is a Linux kernel vulnerability in the net/sched traffic control subsystem. The flaw affects the mirred action, which redirects or mirrors packets between network devices. When mirred redirects packets to ingress from either ingress or egress, the loop detection state stored in the sched_mirred_dev per-CPU array is lost. Two conditions cause this state loss: packet deferral into the backlog queue and clearing of the sched_mirred_dev array. As a result, the kernel fails to detect redirection loops between devices, allowing packets to circulate indefinitely between interfaces configured with reciprocal mirred rules.

Critical Impact
Undetected packet redirection loops between network devices can consume CPU resources and degrade host networking performance, creating a local denial-of-service condition.

Affected Products

Linux kernel (upstream net/sched subsystem)
Distributions shipping kernels using the vulnerable mirred action prior to the fix
Systems using tc traffic control with mirred redirect between ingress and egress

Discovery Timeline

2026-07-19 - CVE-2026-63982 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63982

Vulnerability Analysis

The vulnerability resides in the Linux kernel traffic control (tc) mirred action, which supports redirecting or mirroring packets between network devices at ingress or egress. The kernel maintains a per-CPU sched_mirred_dev array that records devices already visited during a redirection chain. This array is the mechanism used to detect and break redirection loops before packets can circulate indefinitely.

When mirred redirects a packet to ingress from either an ingress or egress hook, the packet is deferred into the CPU backlog for later processing. During this deferral, the sched_mirred_dev array is cleared, so the loop-tracking state accumulated on the current path is discarded. When the deferred packet resumes processing from the backlog, the kernel has no record of the devices already traversed. A cycle such as ethx:ingress -> ethy:egress -> ethx:ingress therefore escapes detection.

Root Cause

The root cause is a lifecycle mismatch between the loop-detection state and the packet processing path. The sched_mirred_dev array is scoped to a single synchronous traversal, but mirred redirection to ingress breaks that traversal by queuing the packet into the backlog. Because the state is not preserved across the deferral boundary, subsequent processing starts with a clean loop-tracking context.

Attack Vector

Exploitation requires the local capability to install tc qdiscs and filters, typically CAP_NET_ADMIN. An operator can construct reciprocal mirred rules that redirect between two devices. The proof-of-concept in the advisory attaches clsact qdiscs to port0 and port1, then installs a filter on port0 egress that redirects to port1 ingress and a filter on port1 ingress that redirects to port0 egress. A single ping triggers a redirection cycle that is not detected by the kernel, causing packets to circulate between the two interfaces.

Refer to the kernel commit 45ac526, commit 66f4607, and commit db87522 for the fix details.

Detection Methods for CVE-2026-63982

Indicators of Compromise

Sustained high CPU utilization in softirq (ksoftirqd) context without corresponding external network load.
Unusually high packet counters on interfaces participating in mirred redirect chains, visible through ip -s link or tc -s filter show.
Presence of tc filters using action mirred ingress redirect or action mirred egress redirect between paired devices.

Detection Strategies

Audit installed tc configurations for mirred actions that redirect between ingress and egress on paired interfaces.
Baseline per-interface packet rates and alert on deviations that cannot be explained by external traffic.
Monitor softnet_stat and per-CPU backlog counters for anomalous growth associated with packet deferral.

Monitoring Recommendations

Collect tc -s qdisc and tc -s filter output from production hosts and store it in a centralized log store for change tracking.
Alert on new mirred actions installed at runtime, particularly when both source and target devices carry reciprocal rules.
Correlate CAP_NET_ADMIN-granting syscalls and tc invocations with process ancestry to identify unauthorized changes.

How to Mitigate CVE-2026-63982

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the advisory as soon as distribution updates are available.
Inventory hosts using mirred redirect actions and validate that filter chains do not create reciprocal ingress/egress cycles.
Restrict CAP_NET_ADMIN and root access to trusted operators and automation identities only.

Patch Information

The fix is available in the mainline Linux kernel through commits 45ac526a0d57, 66f4607fe788, and db875221ab08. The patches preserve the loop-detection state across packet deferral so that cycles involving ingress redirection are correctly identified. Deploy kernel updates from your distribution once the fix has been backported to the affected stable series.

Workarounds

Remove or avoid tcmirred configurations that redirect to ingress across paired devices until the kernel is patched.
Use container and namespace isolation to prevent untrusted workloads from acquiring CAP_NET_ADMIN in the host network namespace.
Enforce configuration management policies that disallow ad-hoc tc changes on production hosts.

bash

# Audit current tc configuration for mirred redirect actions
tc -s filter show dev port0 ingress
tc -s filter show dev port0 egress
tc -s filter show dev port1 ingress
tc -s filter show dev port1 egress

# Remove a suspect mirred filter (example)
tc filter del dev port0 egress prio 10
tc filter del dev port1 ingress prio 10