NULL Pointer Dereference Vulnerability in Linux Kernel Network Scheduler

CVE-2026-31421

What is CVE-2026-31421?

A NULL pointer dereference vulnerability exists in the Linux kernel's network scheduler, specifically within the fw_classify function. This issue arises when shared blocks leave a NULL value for block->q, which leads to a dereference when an empty cls_fw filter is attached. As a result, configurations using the deprecated fw_change method on shared blocks can trigger this vulnerability, leading to potential system instability. The issue has been addressed to ensure that configurations are properly rejected, preventing the circumstances that would cause the NULL pointer dereference.

References