{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow  tcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4) to prevent deep recursion.  However, when the action uses blockcast (tcfm_blockid != 0), the function returns at the tcf_blockcast() call BEFORE reaching the counter increment.  As a result, the recursion counter never advances and the limit check is entirely bypassed.  When two devices share a TC egress block with a mirred blockcast rule, a packet egressing on device A is mirrored to device B via blockcast; device B's egress TC re-enters tcf_mirred_act() via blockcast and mirrors back to A, creating an unbounded recursion loop:    tcf_mirred_act -\u003e tcf_blockcast -\u003e tcf_mirred_to_dev -\u003e dev_queue_xmit   -\u003e sch_handle_egress -\u003e tcf_classify -\u003e tcf_mirred_act -\u003e (repeat)  This recursion continues until the kernel stack overflows.  The bug is reachable from an unprivileged user via unshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant CAP_NET_ADMIN in the new network namespace, which is sufficient to create dummy devices, attach clsact qdiscs with shared blocks, and install mirred blockcast filters.   BUG: TASK stack guard page was hit at ffffc90000b7fff8  Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI  CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410  RIP: 0010:xas_find+0x17/0x480  Call Trace:   xa_find+0x17b/0x1d0   tcf_mirred_act+0x640/0x1060   tcf_action_exec+0x400/0x530   basic_classify+0x128/0x1d0   tcf_classify+0xd83/0x1150   tc_run+0x328/0x620   __dev_queue_xmit+0x797/0x3100   tcf_mirred_to_dev+0x7b1/0xf70   tcf_mirred_act+0x68a/0x1060   [repeating ~30+ times until stack overflow]  Kernel panic - not syncing: Fatal exception in interrupt  Fix this by incrementing sched_mirred_nest before calling tcf_blockcast() and decrementing it on return, mirroring the non-blockcast path.  This ensures subsequent recursive entries see the updated counter and are correctly limited by MIRRED_NEST_LIMIT.",
  "id": "DEBIAN-CVE-2026-63981",
  "modified": "2026-09-14T16:47:37.959463312Z",
  "published": "2026-07-19T16:17:17.283Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-63981"
    }
  ],
  "upstream": [
    "CVE-2026-63981"
  ]
}