The Linux kernel’s net/sched subsystem mishandles TC_ACT_REDIRECT actions originating from eBPF programs or qdisc filters. When such an action is returned, the redirect is silently discarded and the packet continues to the default queue, or in newer kernel versions the missing bpf_net_context can cause a null‑pointer dereference that crashes the kernel. This defect leads to packets not being redirected as intended and can result in a local denial‑of‑service when an attacker injects a malicious eBPF program that triggers TC_ACT_REDIRECT. The weakness stems from improper null‑pointer handling in the classification flow.

This vulnerability is present in all Linux kernels that include the net/sched framework and eBPF integration, meaning any system running a recent kernel is potentially affected. There are no vendor‑specific version constraints listed, so the issue applies to the entire Linux operating system across distributions.

The EPSS score is less than 1 % and the CVE is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The CVSS score of 5.5 points to moderate severity. However, the flaw can be triggered by a local attacker who can load an eBPF program that returns TC_ACT_REDIRECT, which would cause a kernel crash and disrupt system availability. The vulnerability is best mitigated by applying the kernel patch that drains packets when a TC_ACT_REDIRECT is received instead of silently forwarding them.