CVE-2026-63981

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow

tcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4)

to prevent deep recursion. However, when the action uses blockcast

(tcfm_blockid != 0), the function returns at the tcf_blockcast() call

BEFORE reaching the counter increment. As a result, the recursion

counter never advances and the limit check is entirely bypassed.

When two devices share a TC egress block with a mirred blockcast rule,

a packet egressing on device A is mirrored to device B via blockcast;

device B's egress TC re-enters tcf_mirred_act() via blockcast and

mirrors back to A, creating an unbounded recursion loop:

tcf_mirred_act -> tcf_blockcast -> tcf_mirred_to_dev -> dev_queue_xmit

-> sch_handle_egress -> tcf_classify -> tcf_mirred_act -> (repeat)

This recursion continues until the kernel stack overflows.

The bug is reachable from an unprivileg

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References