CVE-2026-23064

A NULL pointer dereference vulnerability was found in the Linux kernel's traffic control IFE (Inter-FE) action module. The tcf_ife_encode() function fails to verify that ife_encode() returns a valid pointer before use. When ife_encode() returns NULL, subsequent calls to ife_tlv_meta_encode() attempt to dereference the NULL pointer, triggering a kernel crash during packet processing.

This vulnerability was discovered by syzkaller and affects systems using the tc (traffic control) IFE action for inter-forwarding-element metadata encapsulation. Triggering this flaw requires the ability to configure traffic control rules, typically requiring root or CAP_NET_ADMIN privileges. The impact is denial of service through a kernel crash during packet transmission.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.