In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: fix error handling causing NULL dereference
tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to caller tcf_exts_init_ex() which sets exts->actions to NULL and returns 1 to caller fl_change().
fl_change() treats err == 1 as success, calling tcf_exts_validate_ex() which calls tcf_action_init() with exts->actions as argument, where it is dereferenced.
Example trace:
BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1 RIP: 0010:tcf_action_init+0x1f8/0x2c0 Call Trace: tcf_action_init+0x1f8/0x2c0 tcf_exts_validate_ex+0x175/0x190 fl_change+0x537/0x1120 [cls_flower]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Dec 3, 2025 | Mar 12, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | Mar 12, 2025 |
| Rocky_linux | — | Upgrade kernel-tools-libs-develUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-modules-extra-matchedUpgrade libperf-debuginfoUpgrade kernelUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade libperfUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade rtlaUpgrade kernel-debugUpgrade kernel-debug-devel-matchedUpgrade perf-debuginfoUpgrade perfUpgrade kernel-uki-virtUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-modules-coreUpgrade kernel-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-devel-matchedUpgrade kernel-coreUpgrade kernel-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extra | Feb 5, 2026 | Nov 27, 2025 |
| Suse | — | Upgrade ocfs2-kmp-rtUpgrade kernel-64kb-develUpgrade dtb-qcomUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade dlm-kmp-64kbUpgrade dtb-apmUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade kernel-azure-extraUpgrade gfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade dtb-exynosUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade kernel-default-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-alteraUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-freescaleUpgrade dtb-mediatekUpgrade kernel-debug-develUpgrade kernel-rt_debugUpgrade dtb-xilinxUpgrade cluster-md-kmp-azureUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-64kbUpgrade kernel-default-develUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade dtb-renesasUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-debug-vdsoUpgrade dtb-socionextUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade kernel-default-base-rebuildUpgrade kernel-source-rtUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-docsUpgrade kernel-develUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-default-baseUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade dlm-kmp-defaultUpgrade dtb-armUpgrade dtb-rockchipUpgrade dtb-caviumUpgrade kselftests-kmp-rtUpgrade kernel-64kb-extraUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdso | Dec 5, 2025 | Jun 12, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-26-generic-64kUpgrade linux-image-6.8.1-1030-realtimeUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1036-gcp-64kUpgrade linux-image-gkeopUpgrade linux-image-gcp-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1032-oracleUpgrade linux-image-raspi-6.8Upgrade linux-image-6.11.0-1015-gcp-64kUpgrade linux-image-raspiUpgrade linux-image-6.11.0-1015-azure-fdeUpgrade linux-image-azureUpgrade linux-image-lowlatency-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-6.11.0-1014-lowlatency-64kUpgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1035-aws-64kUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1033-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-genericUpgrade linux-image-6.8.0-1035-nvidiaUpgrade linux-image-6.8.0-78-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-1022-oemUpgrade linux-image-ibmUpgrade linux-image-oracle-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1035-nvidia-lowlatencyUpgrade linux-image-azure-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1032-gkeUpgrade linux-image-6.8.0-1035-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1010-realtimeUpgrade linux-image-nvidia-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-6.11.0-1015-azureUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-azure-fde-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.11.0-1016-oracleUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.11.0-1016-oracle-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1032-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-awsUpgrade linux-image-6.11.0-1014-lowlatencyUpgrade linux-image-6.8.0-1036-gcpUpgrade linux-image-6.8.0-1035-raspiUpgrade linux-image-6.11.0-1013-raspiUpgrade linux-image-6.8.0-78-lowlatency-64kUpgrade linux-image-6.11.0-1015-gcpUpgrade linux-image-gkeUpgrade linux-image-generic-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-78-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1035-nvidia-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1035-awsUpgrade linux-image-6.8.0-1019-gkeopUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-6.11.0-1014-awsUpgrade linux-image-aws-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-78-genericUpgrade linux-image-6.11.0-26-genericUpgrade linux-image-6.8.0-2028-raspi-realtimeUpgrade linux-image-lowlatency-hwe-24.04 | May 21, 2025 | Mar 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub