PT-2026-61298 · Linux · Linux
CVE-2026-63981
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act mirred: Fix blockcast recursion bypass leading to stack overflow
tcf mirred act() checks sched mirred nest against MIRRED NEST LIMIT (4)
to prevent deep recursion. However, when the action uses blockcast
(tcfm blockid != 0), the function returns at the tcf blockcast() call
BEFORE reaching the counter increment. As a result, the recursion
counter never advances and the limit check is entirely bypassed.
When two devices share a TC egress block with a mirred blockcast rule,
a packet egressing on device A is mirrored to device B via blockcast;
device B's egress TC re-enters tcf mirred act() via blockcast and
mirrors back to A, creating an unbounded recursion loop:
tcf mirred act -> tcf blockcast -> tcf mirred to dev -> dev queue xmit
-> sch handle egress -> tcf classify -> tcf mirred act -> (repeat)
This recursion continues until the kernel stack overflows.
The bug is reachable from an unprivileged user via
unshare(CLONE NEWUSER | CLONE NEWNET): user namespaces grant
CAP NET ADMIN in the new network namespace, which is sufficient to
create dummy devices, attach clsact qdiscs with shared blocks, and
install mirred blockcast filters.
BUG: TASK stack guard page was hit at ffffc90000b7fff8
Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410
RIP: 0010:xas find+0x17/0x480
Call Trace:
xa find+0x17b/0x1d0
tcf mirred act+0x640/0x1060
tcf action exec+0x400/0x530
basic classify+0x128/0x1d0
tcf classify+0xd83/0x1150
tc run+0x328/0x620
dev queue xmit+0x797/0x3100
tcf mirred to dev+0x7b1/0xf70
tcf mirred act+0x68a/0x1060
[repeating ~30+ times until stack overflow]
Kernel panic - not syncing: Fatal exception in interrupt
Fix this by incrementing sched mirred nest before calling
tcf blockcast() and decrementing it on return, mirroring the
non-blockcast path. This ensures subsequent recursive entries see the
updated counter and are correctly limited by MIRRED NEST LIMIT.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux