CVE-2026-68441

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains

When a TC filter attached to a qdisc filter chain returns

TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an

act_bpf action), the redirect was silently lost i.e no qdisc classify

function handled TC_ACT_REDIRECT, so the packet fell through the

switch and was enqueued normally instead of being redirected.

This has been broken since bpf_redirect() was introduced for TC in

commit 27b29f63058d ("bpf: add bpf_redirect() helper"). We got lucky

for a long time because bpf_net_context was a per-CPU variable that

was always available.

commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct

on PREEMPT_RT.") turned bpf_net_context into a task_struct member that

is only set up by explicit callers. Without a caller setting it up,

bpf_redirect() itself crashes with a NULL pointer dereference in

bpf_net_ctx_get_ri(). However, even with bp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References