Bug 2502362 (CVE-2026-63982)

Summary:	CVE-2026-63982 kernel: net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's network scheduler component. This vulnerability occurs when the `mirred` action, used for redirecting network traffic, fails to properly detect a redirection loop. An attacker can exploit this by crafting specific network configurations that cause packets to be endlessly redirected, leading to a Denial of Service (DoS) condition where system resources are exhausted and network operations are disrupted.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:04:01 UTC

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop

When mirred redirects to ingress (from either ingress or egress) the loop
state from sched_mirred_dev array dev is lost because of 1) the packet
deferral into the backlog and 2) the fact the sched_mirred_dev array is
cleared. In such cases, if there was a loop we won't discover it.

Here's a simple test to reproduce:
ip a add dev port0 10.10.10.11/24

tc qdisc add dev port0 clsact
tc filter add dev port0 egress protocol ip \
   prio 10 matchall action mirred ingress redirect dev port1

tc qdisc add dev port1 clsact
tc filter add dev port1 ingress protocol ip \
   prio 10 matchall action mirred egress redirect dev port0

ping -c 1 -W0.01 10.10.10.10

Comment 1 Keith Grant 2026-07-21 23:30:01 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63982-9bf5@gregkh/T