{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-63981 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-63981 is a denial of service vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-63981 and fix it if it is affected.\n\nWhat it is: CVE-2026-63981 is a denial of service vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-63981 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-63981/ (Markdown: https://insights.sbomify.com/CVE-2026-63981/index.md)","id":"CVE-2026-63981","markdown":"https://insights.sbomify.com/CVE-2026-63981/index.md","name":"CVE-2026-63981","record":{"aliases":["DEBIAN-CVE-2026-63981","GHSA-v39p-wrrc-5j75","UBUNTU-CVE-2026-63981"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An unprivileged user can trigger a kernel stack overflow via TC mirred blockcast recursion, causing a system crash.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow\n\ntcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4)\nto prevent deep recursion.  However, when the action uses blockcast\n(tcfm_blockid != 0), the function returns at the tcf_blockcast() call\nBEFORE reaching the counter increment.  As a result, the recursion\ncounter never advances and the limit check is entirely bypassed.\n\nWhen two devices share a TC egress block with a mirred blockcast rule,\na packet egressing on device A is mirrored to device B via blockcast;\ndevice B's egress TC re-enters tcf_mirred_act() via blockcast and\nmirrors back to A, creating an unbounded recursion loop:\n\n  tcf_mirred_act -\u003e tcf_blockcast -\u003e tcf_mirred_to_dev -\u003e dev_queue_xmit\n  -\u003e sch_handle_egress -\u003e tcf_classify -\u003e tcf_mirred_act -\u003e (repeat)\n\nThis recursion continues until the kernel stack overflows.\n\nThe bug is reachable from an unprivileged user via\nunshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant\nCAP_NET_ADMIN in the new network namespace, which is sufficient to\ncreate dummy devices, attach clsact qdiscs with shared blocks, and\ninstall mirred blockcast filters.\n\n BUG: TASK stack guard page was hit at ffffc90000b7fff8\n Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI\n CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410\n RIP: 0010:xas_find+0x17/0x480\n Call Trace:\n  xa_find+0x17b/0x1d0\n  tcf_mirred_act+0x640/0x1060\n  tcf_action_exec+0x400/0x530\n  basic_classify+0x128/0x1d0\n  tcf_classify+0xd83/0x1150\n  tc_run+0x328/0x620\n  __dev_queue_xmit+0x797/0x3100\n  tcf_mirred_to_dev+0x7b1/0xf70\n  tcf_mirred_act+0x68a/0x1060\n  [repeating ~30+ times until stack overflow]\n Kernel panic - not syncing: Fatal exception in interrupt\n\nFix this by incrementing sched_mirred_nest before calling\ntcf_blockcast() and decrementing it on return, mirroring the\nnon-blockcast path.  This ensures subsequent recursive entries see the\nupdated counter and are correctly limited by MIRRED_NEST_LIMIT.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow","id":"CVE-2026-63981","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"net/sched: Fix ethx:ingress -\u003e ethy:egress -\u003e ethx:ingress mirred loop","id":"CVE-2026-63982"},"packages":[],"prev":{"headline":"net/handshake: Use spin_lock_bh for hn_lock","id":"CVE-2026-63980"},"products":["Linux"],"published":"2026-07-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-07-19","vendors":["Linux"]},"summary":"An unprivileged user can trigger a kernel stack overflow via TC mirred blockcast recursion, causing a system crash.","url":"https://insights.sbomify.com/CVE-2026-63981/"}