CVE-2026-23064

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: avoid possible NULL deref

tcfifeencode() must make sure ife_encode() does not return NULL.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ifetlvmetaencode+0x41/0xa0 net/ife/ife.c:166 CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> ifeencodemetau32+0x153/0x180 net/sched/actife.c:101 tcfifeencode net/sched/actife.c:841 [inline] tcfifeact+0x1022/0x1de0 net/sched/actife.c:877 tcact include/net/tcwrapper.h:130 [inline] tcfactionexec+0x1c0/0xa20 net/sched/actapi.c:1152 tcfextsexec include/net/pktcls.h:349 [inline] mallclassify+0x1a0/0x2a0 net/sched/clsmatchall.c:42 tcclassify include/net/tc_wrapper.h:197 [inline] __tcfclassify net/sched/clsapi.c:1764 [inline] tcfclassify+0x7f2/0x1380 net/sched/clsapi.c:1860 multiqclassify net/sched/schmultiq.c:39 [inline] multiqenqueue+0xe0/0x510 net/sched/schmultiq.c:66 devqdiscenqueue+0x45/0x250 net/core/dev.c:4147 __devxmitskb net/core/dev.c:4262 [inline] __devqueuexmit+0x2998/0x46c0 net/core/dev.c:4798