CVE-2026-22987: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22987 is a NULL pointer dereference vulnerability in the Linux kernel's net/sched subsystem (act_api) that can cause a denial of service during network namespace (netns) teardown. The flaw exists in tcf_idrinfo_destroy(), which can pass an ERR_PTR(-EBUSY) value as a valid tc_action pointer to tc_act_in_hw(), resulting in an invalid memory dereference and kernel crash. Affected kernel versions include 6.17 through 6.18.5 and release candidates 6.19-rc1 through 6.19-rc4. It was published on January 23, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). During netns teardown, tcf_idrinfo_destroy() iterates the action IDR (ID Radix tree) and may encounter entries that are ERR_PTR(-EBUSY) error pointers rather than valid tc_action pointers. Without a guard check, these error pointers are passed directly to tc_act_in_hw(), which dereferences them as if they were valid kernel objects, triggering a crash. The bug was originally discovered via syzbot (the Linux kernel fuzzer). The fix involves adding an IS_ERR() check when iterating the action IDR to skip error pointer entries during teardown (Red Hat Bugzilla, kernel.org patch 1, kernel.org patch 2).

Successful exploitation results in a kernel panic and system crash, causing a complete denial of service affecting system availability. Confidentiality and integrity are not impacted. A local attacker with low privileges can trigger the crash by manipulating network namespace teardown conditions, making this a local availability-only vulnerability with no known path to privilege escalation or data exfiltration (Red Hat Advisory).

Update the Linux kernel to version 6.18.6 or later, which includes the fix guarding against ERR_PTR entries in tcf_idrinfo_destroy(). The patches are available in kernel stable commits 67550a1130b647bb0d093c9c0a810c69aa6a30a8 and adb25a46dc0a43173f5ea5f5f58fc8ba28970c7c. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (kernel.org patch 1, kernel.org patch 2).