CVE-2026-68441: Linux Kernel TC_ACT_REDIRECT DoS Flaw

CVE-2026-68441 Overview

CVE-2026-68441 is a Linux kernel vulnerability in the net/sched traffic control subsystem. When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT via an eBPF program calling bpf_redirect() or an act_bpf action, the redirect verdict was silently dropped by qdisc classify functions. After commit 401cb7dae813 moved bpf_net_context from a per-CPU variable to a task_struct member, bpf_redirect() triggers a NULL pointer dereference in bpf_net_ctx_get_ri() when invoked without a caller that initializes the context.

Critical Impact

A local user able to attach eBPF TC filters to qdisc filter chains can trigger a NULL pointer dereference in the kernel network stack, causing a denial of service.

Affected Products

• Linux kernel versions containing commit 27b29f63058d (introduction of bpf_redirect() helper for TC)
• Linux kernel versions after commit 401cb7dae813 that reference bpf_net_context via task_struct
• Distributions shipping affected mainline and stable Linux kernels

Discovery Timeline

• 2026-08-12 - CVE-2026-68441 published to NVD
• 2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68441

Vulnerability Analysis

The Linux kernel traffic control (TC) subsystem allows filters to return verdicts such as TC_ACT_OK, TC_ACT_SHOT, and TC_ACT_REDIRECT. Qdisc classify functions in net/sched/ handle these verdicts through a switch statement. TC_ACT_REDIRECT was never handled in that switch, so packets tagged for redirect fell through and were enqueued normally.

This behavior remained latent because bpf_net_context used to be a per-CPU variable, always available in any execution context. The issue transitioned from silent packet mishandling to an active kernel crash after bpf_net_context became a task_struct field requiring explicit initialization by callers.

Root Cause

The root cause is dual. First, no qdisc classify function invoked skb_do_redirect() in response to TC_ACT_REDIRECT, meaning the verdict was silently discarded since commit 27b29f63058d. Second, after commit 401cb7dae813, invoking bpf_redirect() from a code path that does not initialize bpf_net_context produces a NULL pointer dereference in bpf_net_ctx_get_ri().

Attack Vector

A local user with the capability to attach eBPF programs or act_bpf actions to qdisc filter chains can construct a filter that returns TC_ACT_REDIRECT. When the qdisc classify path processes a packet against that filter without an initialized bpf_net_context, the kernel dereferences a NULL pointer and panics. The clsact fast path (tc_run()) is unaffected because it calls tcf_classify() directly and honors TC_ACT_REDIRECT through sch_handle_egress() and sch_handle_ingress().

The upstream fix introduces a tcf_classify_qdisc() inline helper in pkt_cls.h that wraps tcf_classify(). When the verdict is TC_ACT_REDIRECT, the wrapper converts it to TC_ACT_SHOT, dropping the packet so the misconfiguration is visible to the operator rather than crashing or silently succeeding.

Detection Methods for CVE-2026-68441

Indicators of Compromise

• Kernel panic or oops messages referencing bpf_net_ctx_get_ri in the call stack
• Unexpected packet drops on interfaces with qdisc-attached eBPF filters using bpf_redirect()
• tc filter configurations that attach act_bpf or eBPF programs invoking bpf_redirect() to non-clsact qdiscs

Detection Strategies

• Enumerate loaded eBPF programs and TC filter chains using bpftool prog list and tc filter show to identify programs calling bpf_redirect() outside the clsact fast path
• Monitor dmesg and kernel crash telemetry for NULL pointer dereferences originating in net/core/filter.c or net/sched/
• Correlate kernel version against the fixing commits c8fd74445e86 and ec48b3be2c85 to identify unpatched hosts

Monitoring Recommendations

• Ingest kernel logs and crash dumps into a centralized data lake to alert on repeated network-stack oops events
• Track process capabilities granting CAP_NET_ADMIN and CAP_BPF, which enable filter attachment
• Baseline TC configuration changes and alert on the addition of act_bpf actions to qdiscs other than clsact

How to Mitigate CVE-2026-68441

Immediate Actions Required

• Apply the upstream kernel patches referenced by commits c8fd74445e86 and ec48b3be2c85 from the Linux stable tree
• Restrict CAP_NET_ADMIN and CAP_BPF to trusted administrative users and service accounts
• Audit existing TC filter chains for eBPF programs invoking bpf_redirect() on non-clsact qdiscs

Patch Information

The fix adds a tcf_classify_qdisc() inline helper in include/net/pkt_cls.h that wraps tcf_classify() and converts TC_ACT_REDIRECT verdicts to TC_ACT_SHOT for qdisc classify callers and tcf_qevent_handle(). Patches are available at the Kernel Git Commit c8fd74445e86 and Kernel Git Commit ec48b3be2c85. Update to a distribution kernel that includes these commits.

Workarounds

• Remove or disable eBPF programs and act_bpf actions attached to non-clsact qdiscs that invoke bpf_redirect()
• Confine untrusted workloads with seccomp or user namespace restrictions that prevent unprivileged eBPF loading
• Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading eBPF programs

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf.conf

# Audit qdisc filter chains for bpf_redirect usage
for iface in $(ls /sys/class/net); do
  tc filter show dev "$iface" ingress 2>/dev/null
  tc filter show dev "$iface" egress 2>/dev/null
done