CVE-2026-68337 Overview
CVE-2026-68337 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The bpf_redirect*() helpers and skb_do_redirect() unconditionally dereference current->bpf_net_context through bpf_net_ctx_get_ri(). When cls_bpf or act_bpf programs run from a qdisc path such as the red qdisc qevent early_drop block, the per-task BPF network context is never established. Invoking a redirect from that path triggers a NULL pointer dereference and kernel crash. The issue affects Linux kernel builds that support tc BPF classifier and action programs attached to qdiscs.
Critical Impact
Unprivileged qdisc-attached tc BPF programs can trigger a kernel NULL pointer dereference, resulting in denial of service on affected Linux hosts.
Affected Products
- Linux kernel with BPF and tc classifier/action support enabled
- Systems using cls_bpf or act_bpf attached to qdiscs such as red with qevent blocks
- Distributions shipping vulnerable kernel versions prior to the upstream fix
Discovery Timeline
- 2026-08-10 - CVE-2026-68337 published to the National Vulnerability Database
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68337
Vulnerability Analysis
The Linux kernel maintains per-task BPF redirect state in current->bpf_net_context. Standard tc BPF entry points such as sch_handle_ingress() and sch_handle_egress() establish this context before invoking BPF programs. The bpf_net_ctx_get_ri() accessor then reads the bpf_redirect_info structure without a NULL check.
The qdisc qevent path breaks this assumption. When a cls_bpf or act_bpf program attaches to a qdisc block through tc filter add block ... bpf obj redirect.o, the invoking code path never sets up the network context. Any redirect operation from that program dereferences a NULL pointer in kernel space.
The upstream fix rejects redirect operations when the context is absent. The helpers now check for a valid bpf_net_context and return an error, and tcf_qevent_handle() drops packets carrying a TC_ACT_REDIRECT verdict instead of forwarding them to skb_do_redirect().
Root Cause
The root cause is an unchecked pointer dereference [CWE-476] in BPF redirect helpers. The code assumed all callers of bpf_redirect(), bpf_redirect_peer(), bpf_redirect_neigh(), and skb_do_redirect() execute inside a context where bpf_net_ctx_set() has already run. The qdisc qevent dispatch path violates that invariant.
Attack Vector
A local user with the CAP_NET_ADMIN capability, or a container with delegated network administration privileges, can attach a tc BPF program to a qdisc block. Two triggering conditions exist. First, the program explicitly calls bpf_redirect(), which crashes at the top of the helper. Second, the program returns TC_ACT_REDIRECT without a helper call, causing tcf_qevent_handle() to dispatch to skb_do_redirect() and dereference the NULL context. Either path panics the kernel and denies service to all workloads on the host.
No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commits referenced below.
Detection Methods for CVE-2026-68337
Indicators of Compromise
- Kernel oops or panic messages referencing bpf_net_ctx_get_ri, skb_do_redirect, or tcf_qevent_handle in dmesg or /var/log/kern.log
- Unexpected node reboots on hosts running container workloads with delegated CAP_NET_ADMIN
- Presence of tc filters using bpf action attached to qevent blocks on red or similar qdiscs
Detection Strategies
- Audit hosts with tc filter show block <id> and tc qdisc show to identify BPF programs attached to qdisc qevent blocks
- Monitor auditd for bpf() syscall and tc command execution originating from non-root or container namespaces
- Correlate kernel crash telemetry with recent tc BPF program loads on the same host
Monitoring Recommendations
- Forward kernel logs and syslog to a centralized SIEM and alert on BPF-related oops signatures
- Track loaded BPF programs with bpftool prog list on a scheduled basis and baseline expected programs
- Alert on tc command usage inside unprivileged containers or from unexpected service accounts
How to Mitigate CVE-2026-68337
Immediate Actions Required
- Apply the upstream kernel patch series referenced in the kernel commit 3f4920d165b2 and kernel commit cabfacbd5af0
- Update to a distribution kernel that includes the fix once vendors ship backports
- Review and remove tc BPF filters attached to qdisc qevent blocks until the patched kernel is installed
Patch Information
The fix has landed upstream. Two commits address the issue: 3f4920d165b29052255527d8ae7619e7ec132ece and cabfacbd5af09d3ae898ca224c4a1459e9bba15d. The patches make redirect helpers refuse to operate when no bpf_net_context exists, and cause tcf_qevent_handle() to drop a TC_ACT_REDIRECT verdict rather than call skb_do_redirect(). Distribution maintainers should backport both commits to supported stable branches.
Workarounds
- Remove or avoid attaching cls_bpf and act_bpf programs to qdisc qevent blocks such as red ... qevent early_drop block N
- Restrict CAP_NET_ADMIN inside untrusted containers and workloads to prevent qdisc modification
- Use seccomp or Landlock policies to constrain the bpf() and tc syscall surface where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
