CVE-2026-31421 net/sched: cls_fw: fix NULL pointer dereference on shared blocks
A NULL pointer dereference in the Linux kernel's traffic control classifier allows local attackers to cause a system crash by attaching specific filters to shared blocks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31421?
CVE-2026-31421 is a medium-severity vulnerability in Linux kernel, published on 13 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty cls_fw filter is attached to a shared block and a packet with a nonzero major skb mark is classified.
Reject the configuration in fw_change() when the old method (no TCA_OPTIONS) is used on a shared block, since fw_classify()'s old-method path needs block->q which is NULL for shared blocks.
The fixed null-ptr-deref calling stack: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fw_classify (net/sched/cls_fw.c:81) Call Trace: tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860) tc_run (net/core/dev.c:4401) __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)
Weakness: CWE-476
Which versions are affected by CVE-2026-31421?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31421?
Apply the vendor's patch.
Is CVE-2026-31421 being exploited?
There is no known exploitation of CVE-2026-31421 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-82721, BELL-CVE-2026-31421, DEBIAN-CVE-2026-31421, GHSA-pmqm-g7jm-76hf, ROOT-OS-DEBIAN-11-CVE-2026-31421, ROOT-OS-DEBIAN-12-CVE-2026-31421 and 4 more.