CVE-2026-53080: Linux Kernel TC Classifier NULL Dereference DoS Vulnerability

Technical summary

CVE-2026-53080 stems from a race condition in the cls_fw (firewall mark classifier) module within the Linux kernel's netlink-based TC subsystem. The root cause is a change in filter publication semantics: since commit ed76f5edccc9, filters are added to a shared filter chain and exposed to the datapath before their ->change() callback completes validation. For cls_fw, this means an invalid filter can briefly exist in the packet classification path. When packets arrive during this window, fw_classify() may attempt to dereference filter metadata on a NULL or partially-initialized filter object, specifically the handle field. The kernel's internal validation logic eventually destroys the bad filter, but not before triggering a WARN_ON() and potentially a NULL pointer dereference with a kernel panic (address 0x38 offset in the fw_classify function). The issue is exacerbated on shared blocks where multiple filters coexist and racing packet processing becomes more likely.

Business impact

A local unprivileged user with the ability to add TC rules—typically available to users in network or container namespaces—can crash the kernel and take down networking on the affected system. In containerized or multi-tenant environments, this becomes a lateral denial-of-service vector. In virtualized deployments, a guest user could crash the host kernel. The impact is primarily availability; no data exfiltration or privilege escalation occurs, but service disruption can be complete and immediate.

Affected systems

The Linux kernel is affected. The vulnerability stems from a change introduced in an earlier commit affecting the filter chain synchronization mechanism. Kernels running on systems where unprivileged users or container tenants can manipulate TC rules are at risk. This includes standard Linux distributions running on servers, workstations, and virtualized/containerized platforms. Embedded systems running Linux with exposed TC configuration are also affected if running a vulnerable kernel version.

Exploitability

Exploitation requires local access and the ability to execute TC (traffic control) commands, which typically requires CAP_NET_ADMIN capability or access to a namespace where such privileges are available. The attack is deterministic: the race condition can be reliably triggered by running the sequence of TC filter operations described in the CVE. A proof-of-concept script exists in the public record. No network access or special configuration is needed beyond the ability to add TC filters and transmit packets. Unprivileged container users in many orchestration platforms would have sufficient capability to trigger this.

Remediation

Apply a Linux kernel patch that prevents fw_classify() from operating on invalid 'old-style' filters on shared blocks. The fix involves skipping the old-style classification path in fw_classify() when the filter belongs to a shared block, eliminating the race condition window. This must be done through a kernel update from your distribution. Verify the patch version against your vendor's advisory, as mainline kernel patches may be backported with different version numbers across distributions.

Patch guidance

Contact your Linux distribution vendor (Red Hat, Debian, Ubuntu, etc.) for a kernel update addressing CVE-2026-53080. The fix is a targeted change to the cls_fw module's fw_classify() function. Prioritize this kernel update for systems where unprivileged users can execute TC commands or where container workloads are isolated by network namespaces. Testing in a non-production environment is recommended, though the patch itself is minimal and low-risk. Verify that the applied patch includes the specific fix to prevent old-style classification on shared blocks.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for the WARN_ON message originating from net/sched/cls_fw.c line 88 and for NULL pointer dereference panics with RIP pointing to fw_classify(). This warning appears before the crash occurs. On affected systems, use network performance monitoring to detect unexpected kernel panics during TC rule manipulation. For container platforms, monitor system-level crashes correlated with container network policy changes or updates. Runtime security tools can watch for CAP_NET_ADMIN usage by unprivileged processes or containers as a precursor indicator.

Why prioritize this

This vulnerability merits prompt patching because it is a local denial-of-service vector with a low barrier to exploitation for anyone with CAP_NET_ADMIN privileges. In modern environments with containers, Kubernetes, and user namespaces, the effective attack surface is broad. While the CVSS score is medium (5.5), the real-world impact—complete system crash via local privilege escalation path—justifies high priority in cloud and container environments. The fix is stable and carries minimal risk.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects an attack vector limited to local access and requiring moderate privileges (CAP_NET_ADMIN). The attack complexity is low, and the impact on availability is high (kernel crash). However, confidentiality and integrity are not affected. The score does not account for the broader attack surface in container and namespace-enabled systems where such privileges are more readily available to untrusted users, nor does it capture the severity of a full system crash. In those contexts, the practical risk is higher.

Frequently asked questions