Medium 5.5Published Apr 13, 2026

CVE-2026-31422net/sched: cls_flow: fix NULL pointer dereference on shared blocks

Updated under an hour ago (Oct 26, 2026, 7:00 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: fix NULL pointer dereference on shared blocks flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block. Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below: ======================================================================= KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] =======================================================================

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1abf272022cf1d18469405f47b4ec49c6a3125db before 57f94ac7e953eece5ed4819605a18f3cdfc63dcc; from 1abf272022cf1d18469405f47b4ec49c6a3125db before 942813276edeb1741fa5b0a73471beb4e495fa08; from 1abf272022cf1d18469405f47b4ec49c6a3125db before cc707a4fd4c3b6ab2722e06bc359aa010e13d408; from 1abf272022cf1d18469405f47b4ec49c6a3125db before 4a09f72007201c9f667dc47f64517ec23eea65e5; from 1abf272022cf1d18469405f47b4ec49c6a3125db before 9bf5fc36a43f7b8b5507c96e74fb81f1e8b4957e; from 1abf272022cf1d18469405f47b4ec49c6a3125db before a208c3e1232997e9317887294c20008dfcb75449; from 1abf272022cf1d18469405f47b4ec49c6a3125db before 415ea0c973c754b9f375225807810eb9045f4293; 1abf272022cf1d18469405f47b4ec49c6a3125db builds before 1a280dd4bd1d616a01d6ffe0de284c907b555504	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.15 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/57f94ac7e953eece5ed4819605a18f3cdfc63dcc	patch
https://git.kernel.org/stable/c/942813276edeb1741fa5b0a73471beb4e495fa08	patch
https://git.kernel.org/stable/c/cc707a4fd4c3b6ab2722e06bc359aa010e13d408	patch
https://git.kernel.org/stable/c/4a09f72007201c9f667dc47f64517ec23eea65e5	patch
https://git.kernel.org/stable/c/9bf5fc36a43f7b8b5507c96e74fb81f1e8b4957e	patch
https://git.kernel.org/stable/c/a208c3e1232997e9317887294c20008dfcb75449	patch
https://git.kernel.org/stable/c/415ea0c973c754b9f375225807810eb9045f4293	patch
https://git.kernel.org/stable/c/1a280dd4bd1d616a01d6ffe0de284c907b555504	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.