CVE-2026-22987 — NULL Pointer Dereference in Linux

CWE-476 — NULL Pointer DereferenceCWE-252 — Unchecked Return Value6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 94.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedJan 23

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot reported a crash in tc_act_in_hw() during netns teardown where tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action pointer, leading to an invalid dereference. Guard against ERR_PTR entries when iterating the action IDR so teardown does not call tc_act_in_hw() on an error pointer.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel6.17 — 6.18.6+1
▶Debianlinux/linux_kernel< 6.18.8-1
▶CVEListV5linux/linux84a7d6797e6a03705e6b48c613fa424662049d87 — 67550a1130b647bb0d093c9c0a810c69aa6a30a8+2
▶debiandebian/linux< linux 6.18.8-1 (forky)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-39xq-39v8-2g6g: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot re↗2026-01-23
▶
OSV
CVE-2026-22987: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot repo↗2026-01-23
▶

📋Vendor Advisories

2
Red Hat
kernel: Linux kernel: Denial of Service due to invalid dereference in networking scheduler during netns teardown↗2026-01-23
▶
Debian
CVE-2026-22987: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-22987 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶