NULL pointer dereference in Linux kernel - CVE-2026-53080
Published: June 25, 2026
Vulnerability identifier: #VU135221
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53080
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the cls_fw classifier when classifying packets with an invalid old-style filter on a shared block. A local user can send crafted traffic while creating such a filter to cause a denial of service.
Exploitation requires the ability to configure traffic control filters and trigger packet classification.
How to mitigate CVE-2026-53080
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/41845bc5bb64f3d615abe575ad655b5e7f193634
- https://git.kernel.org/stable/c/4fabcfea7a9dd159df32c5df6587fe858cb0d748
- https://git.kernel.org/stable/c/5dcce34c57d5e5990869384d69deeb9414bf9b92
- https://git.kernel.org/stable/c/5df49f0579f7e625f2358a219d31fbc7621be799
- https://git.kernel.org/stable/c/65782b2db7321d5f97c16718c4c7f6c7205a56be
- https://git.kernel.org/stable/c/829808cbf8cf8a6d07a0e67a5ea2c3fcd63a9e5c
- https://git.kernel.org/stable/c/a719275da488835e987d28effc04679b4aace3a0
- https://git.kernel.org/stable/c/c205da704c84eeb4247d770150440294fd547049