This vulnerability in the Linux kernel enables a crash of the system when a BPF program performs a redirect without a valid bpf_net_context. The issue arises from an unconditional dereference of a NULL pointer in the bpf_redirect*() helpers and skb_do_redirect(). When a tc BPF program is executed through a qdisc that does not establish a bpf_net_context, the kernel attempts to access that context and triggers a fault. The resulting crash leads to a denial of service by terminating kernel threads and potentially taking the entire system offline. The weakness is a classic NULL pointer dereference.

Affected: The Linux kernel on all versions that have not applied the fix referenced in commits 3f4920d165b29052255527d8ae7619e7ec132ece and cabfacbd5af09d3ae898ca224c4a1459e9bba15d. The vulnerability exists in the BPF subsystem when tc BPF programs are attached to a qdisc lacking a proper bpf_net_context. No specific kernel release or major version is listed, so any Linux installation that permits the use of tc BPF with redirect helpers could be impacted. Based on the description, this inference applies to all Linux installations that permit the use of tc BPF with redirect helpers.

The bug is a local issue that requires the attacker to control the creation of tc BPF programs or the configuration of filters that trigger the redirect helper. Based on the description, it is inferred that the attack vector is to add a tc filter with a BPF object that calls bpf_redirect() or returns TC_ACT_REDIRECT, which is then processed on a qdisc path that has no bpf_net_context. Exploitation is straightforward for a user with sufficient privileges to run tc commands. Because the result is a kernel crash, the impact is a denial of service rather than privilege escalation. The CVSS score of 4.1 indicates a low to medium severity, and the EPSS score of < 1% suggests a very low probability of exploitation; the vulnerability is not listed in CISA KEV catalog, but the crash potential still warrants attention.