CVE-2026-63981

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow<br /> <br /> tcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4)<br /> to prevent deep recursion. However, when the action uses blockcast<br /> (tcfm_blockid != 0), the function returns at the tcf_blockcast() call<br /> BEFORE reaching the counter increment. As a result, the recursion<br /> counter never advances and the limit check is entirely bypassed.<br /> <br /> When two devices share a TC egress block with a mirred blockcast rule,<br /> a packet egressing on device A is mirrored to device B via blockcast;<br /> device B&amp;#39;s egress TC re-enters tcf_mirred_act() via blockcast and<br /> mirrors back to A, creating an unbounded recursion loop:<br /> <br /> tcf_mirred_act -&gt; tcf_blockcast -&gt; tcf_mirred_to_dev -&gt; dev_queue_xmit<br /> -&gt; sch_handle_egress -&gt; tcf_classify -&gt; tcf_mirred_act -&gt; (repeat)<br /> <br /> This recursion continues until the kernel stack overflows.<br /> <br /> The bug is reachable from an unprivileged user via<br /> unshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant<br /> CAP_NET_ADMIN in the new network namespace, which is sufficient to<br /> create dummy devices, attach clsact qdiscs with shared blocks, and<br /> install mirred blockcast filters.<br /> <br /> BUG: TASK stack guard page was hit at ffffc90000b7fff8<br /> Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI<br /> CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410<br /> RIP: 0010:xas_find+0x17/0x480<br /> Call Trace:<br /> xa_find+0x17b/0x1d0<br /> tcf_mirred_act+0x640/0x1060<br /> tcf_action_exec+0x400/0x530<br /> basic_classify+0x128/0x1d0<br /> tcf_classify+0xd83/0x1150<br /> tc_run+0x328/0x620<br /> __dev_queue_xmit+0x797/0x3100<br /> tcf_mirred_to_dev+0x7b1/0xf70<br /> tcf_mirred_act+0x68a/0x1060<br /> [repeating ~30+ times until stack overflow]<br /> Kernel panic - not syncing: Fatal exception in interrupt<br /> <br /> Fix this by incrementing sched_mirred_nest before calling<br /> tcf_blockcast() and decrementing it on return, mirroring the<br /> non-blockcast path. This ensures subsequent recursive entries see the<br /> updated counter and are correctly limited by MIRRED_NEST_LIMIT.