CVE-2026-63981

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack overflow occurs in the Linux kernel due to a recursion bypass in the tcf mirred act() function. The function uses a counter sched mirred nest to limit recursion depth, but when the action utilizes blockcast (tcfm blockid != 0), the function returns during the tcf blockcast() call before the counter is incremented. This allows an unbounded recursion loop to form when two devices share a TC egress block with a mirred blockcast rule, as packets are mirrored back and forth between devices until the kernel stack overflows. An unprivileged user can trigger this by using unshare(CLONE NEWUSER | CLONE NEWNET) to gain CAP NET ADMIN privileges within a new network namespace, enabling the creation of dummy devices and the installation of mirred blockcast filters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.