CVE-2026-23064

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: avoid possible NULL deref

tcf_ife_encode() must make sure ife_encode() does not return NULL.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166

CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full)

Call Trace:

<TASK>

ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101

tcf_ife_encode net/sched/act_ife.c:841 [inline]

tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877

tc_act include/net/tc_wrapper.h:130 [inline]

tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152

tcf_exts_exec include/net/pkt_cls.h:349 [inline]

mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42

tc_classify include/net/tc_wrapper.h:197 [inline]

__tcf_classify net/sched/cls_api.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References