The Linux kernel's net/sched subsystem contains a vulnerability in the act_mirred function where the recursion limit check is bypassed during blockcast actions. Specifically, when tcf_mirred_act() calls tcf_blockcast(), it returns before incrementing the recursion counter sched_mirred_nest, allowing unbounded recursion between devices sharing a TC egress block with mirred blockcast rules. This leads to a kernel stack overflow and system crash. The flaw is reachable by unprivileged users who can create user namespaces with CAP_NET_ADMIN privileges, enabling them to create dummy devices, attach clsact qdiscs with shared blocks, and install mirred blockcast filters to trigger the recursion.

Exploitation of this vulnerability results in a kernel stack overflow causing a kernel panic and system crash. This can lead to denial of service on affected Linux systems. The vulnerability is exploitable by unprivileged users with access to user namespaces that grant CAP_NET_ADMIN, potentially allowing local denial of service without requiring elevated privileges on the host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves incrementing the recursion counter before the blockcast call and decrementing it after, ensuring the recursion limit is enforced. Until a patch is applied, avoid configurations that share TC egress blocks with mirred blockcast rules between devices, and restrict unprivileged user access to user namespaces with CAP_NET_ADMIN capabilities.