CVE-2026-31421

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_fw: fix NULL pointer dereference on shared blocks

The old-method path in fw_classify() calls tcf_block_q() and

dereferences q->handle. Shared blocks leave block->q NULL, causing a

NULL deref when an empty cls_fw filter is attached to a shared block

and a packet with a nonzero major skb mark is classified.

Reject the configuration in fw_change() when the old method (no

TCA_OPTIONS) is used on a shared block, since fw_classify()'s

old-method path needs block->q which is NULL for shared blocks.

The fixed null-ptr-deref calling stack:

KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]

RIP: 0010:fw_classify (net/sched/cls_fw.c:81)

Call Trace:

tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)

tc_run (net/core/dev.c:4401)

__dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References