CVE-2026-53080

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_fw: fix NULL dereference of "old" filters before change()

Like pointed out by Sashiko [1], since commit ed76f5edccc9 ("net: sched:

protect filter_chain list with filter_chain_lock mutex") TC filters are

added to a shared block and published to datapath before their ->change()

function is called. This is a problem for cls_fw: an invalid filter

created with the "old" method can still classify some packets before it

is destroyed by the validation logic added by Xiang.

Therefore, insisting with repeated runs of the following script:

# ip link add dev crash0 type dummy

# ip link set dev crash0 up

# mausezahn crash0 -c 100000 -P 10 \

> -A 4.3.2.1 -B 1.2.3.4 -t udp "dp=1234" -q &

# sleep 1

# tc qdisc add dev crash0 egress_block 1 clsact

# tc filter add block 1 protocol ip prio 1 matchall \

> action skbedit mark 65536 continue

# tc filter add block 1 protocol ip prio 2 fw

# ip link del dev crash0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References