Skip to main content

Linux Kernel CVE-2026-31422

| EUVDEUVD-2026-21946 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-13 Linux GHSA-6pmm-j8mh-qwgf
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
4.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
May 20, 2026 - 18:23 vuln.today
CVSS changed
May 20, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch released
Apr 18, 2026 - 09:16 nvd
Patch available
Patch available
Apr 16, 2026 - 05:29 EUVD
4a09f72007201c9f667dc47f64517ec23eea65e5,415ea0c973c754b9f375225807810eb9045f4293,1a280dd4bd1d616a01d6ffe0de284c907b555504
EUVD ID Assigned
Apr 13, 2026 - 13:45 euvd
EUVD-2026-21946
CVE Published
Apr 13, 2026 - 13:40 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_flow: fix NULL pointer dereference on shared blocks

flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block.

Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below:

=============== KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] ===============

AnalysisAI

NULL pointer dereference in the Linux kernel's net/sched cls_flow traffic classifier allows a local low-privileged attacker to crash the kernel (denial of service) by creating a flow filter on a shared traffic control block without a fully qualified baseclass. The crash occurs in flow_change() at net/sched/cls_flow.c:508, confirmed by a KASAN trace showing null-ptr-deref when block->q is dereferenced on a shared block where it is intentionally NULL. No active exploitation confirmed - not listed in CISA KEV - and EPSS stands at 0.02% (7th percentile), indicating negligible real-world exploitation probability at time of analysis.

Technical ContextAI

The Linux kernel traffic control (tc) subsystem provides the cls_flow classifier (net/sched/cls_flow.c) for packet classification based on flow attributes. In flow_change(), the code calls tcf_block_q() to retrieve the associated qdisc queue and then dereferences block->q->handle to derive a default baseclass for the flow filter. Shared blocks - a feature allowing multiple qdiscs to reference a single filter block - intentionally set block->q to NULL, as no single qdisc owns the block. The code failed to call tcf_block_shared() before accessing block->q, violating the API contract for shared blocks. CWE-476 (NULL Pointer Dereference) is the root cause class: the pointer is consumed without a NULL guard. The fix adds a tcf_block_shared() check at the top of the affected code path and returns -EINVAL, rejecting shared-block filter creation that lacks an explicit baseclass. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel version: 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or 7.0, as confirmed by the EUVD data and upstream stable commits. The authoritative fix commits are indexed at https://git.kernel.org/stable/c/cc707a4fd4c3b6ab2722e06bc359aa010e13d408 and related stable-tree commits listed in references. For systems where an immediate kernel upgrade is not feasible, restrict access to tc (traffic control) operations by enforcing that only processes with CAP_NET_ADMIN in the initial network namespace - not within user-created namespaces - can modify traffic classifiers; this is achievable via seccomp profiles or LSM policy (AppArmor/SELinux) blocking rtnetlink operations for unprivileged users. Note that disabling user namespace creation system-wide (sysctl kernel.unprivileged_userns_clone=0 on supported distros) eliminates the container-based escalation path but may break legitimate container workloads. Distribution-specific kernel packages (RHEL, Debian, Ubuntu) should be monitored for backported fixes.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Server 12 SP5-LTSS Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

Share

CVE-2026-31422 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy