Kernel Stack Overflow Due to Blockcast Recursion in Linux Kernel

CVE-2026-63981

What is CVE-2026-63981?

A vulnerability in the Linux kernel allows an unprivileged user to exploit a flaw in the tcf_mirred_act function. This flaw can lead to an unbounded recursion loop when mirroring packets using blockcast rules across two devices. The function fails to appropriately track recursion depth, leading to a stack overflow condition. By leveraging user namespaces to gain CAP_NET_ADMIN privileges, attackers can create dummy devices and install malicious mirred blockcast filters to exploit this vulnerability, ultimately causing kernel panic and disruption of system stability.

References