CVE-2026-63982

net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop

published July 19, 2026

CVSS
—
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop

When mirred redirects to ingress (from either ingress or egress) the loop

state from sched_mirred_dev array dev is lost because of 1) the packet

deferral into the backlog and 2) the fact the sched_mirred_dev array is

cleared. In such cases, if there was a loop we won't discover it.

Here's a simple test to reproduce:

ip a add dev port0 10.10.10.11/24

tc qdisc add dev port0 clsact

tc filter add dev port0 egress protocol ip \

prio 10 matchall action mirred ingress redirect dev port1

tc qdisc add dev port1 clsact

tc filter add dev port1 ingress protocol ip \

prio 10 matchall action mirred egress redirect dev port0

ping -c 1 -W0.01 10.10.10.10

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.2th percentile
Published
2026-07-19T14:56Z
EPSS history
Timeline
  • 19 JUL 14:56Z
    net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
    cvelistv5