CVE-2026-68337

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject redirect helpers without a bpf_net_context

The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task

bpf_redirect_info via bpf_net_ctx_get_ri(), which dereferences the

current->bpf_net_context unconditionally. That context is established

on the paths that run tc BPF such as sch_handle_{ingress,egress}(),

*except* for the case where {cls,act}_bpf was attached to a proper

qdisc. A program running from there reaches the NULL deref in two ways:

* It calls bpf_redirect() directly, which dereferences the context at

the top of the helper:

tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \

avpkt 1000 burst 100 qevent early_drop block 10

tc filter add block 10 pref 1 bpf obj redirect.o

* It simply returns TC_ACT_REDIRECT without helper call: tcf_qevent_handle()

then dispatches to skb_do_redirect(), which dereferences the context

Rather than extending bpf_ne

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References