CVE-2026-68337

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject redirect helpers without a bpfnetcontext

The bpfredirect*() helpers and skbdoredirect() obtain the per-task bpfredirectinfo via bpfnetctxgetri(), which dereferences the current->bpfnetcontext unconditionally. That context is established on the paths that run tc BPF such as schhandle_{ingress,egress}(), except for the case where {cls,act}_bpf was attached to a proper qdisc. A program running from there reaches the NULL deref in two ways:

• It calls bpf_redirect() directly, which dereferences the context at the top of the helper:

  tc qdisc add dev eth0 root handle 1: red limit 1MB min 10KB max 20KB \ avpkt 1000 burst 100 qevent early_drop block 10 tc filter add block 10 pref 1 bpf obj redirect.o

• It simply returns TCACTREDIRECT without helper call: tcfqeventhandle() then dispatches to skbdoredirect(), which dereferences the context

Rather than extending bpfnetcontext management into the qdisc path, make the redirect helpers refuse to operate when no context exists, and have tcfqeventhandle() drop a TCACTREDIRECT verdict instead of calling skbdoredirect(). Previous behaviour was a crash, so nothing regresses by not supporting it.