The Linux kernel vulnerability (CVE-2026-68441) involves improper handling of the TC_ACT_REDIRECT action returned by TC filters attached to qdisc filter chains. When a filter returns TC_ACT_REDIRECT (for example, via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost because no qdisc classify function handled this action. Consequently, packets were enqueued normally instead of being redirected. This issue originated with the introduction of bpf_redirect() for TC and was exacerbated by changes in how bpf_net_context is managed in PREEMPT_RT kernels. The resolution involved adding a helper function that converts TC_ACT_REDIRECT to TC_ACT_SHOT (dropping the packet) in qdisc classify functions, ensuring that failed redirects cause packet loss rather than silent failure. The clsact fast path remains unaffected and continues to handle TC_ACT_REDIRECT correctly.

Packets intended to be redirected by TC filters in qdisc filter chains were instead silently passed through, causing the redirect to fail without any immediate indication to users. This could lead to unexpected network behavior and troubleshooting difficulties. The fix causes packets to be dropped when redirect cannot be honored, making failures visible through packet loss.

A fix has been implemented in the Linux kernel to handle TC_ACT_REDIRECT correctly in qdisc filter chains by dropping packets when redirect cannot be honored. Users should update to the patched kernel versions once available. Patch status is not explicitly stated in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the current remediation guidance.