Executive brief
The Linux kernel's traffic classification scheduler contains a use-after-free vulnerability in the network traffic control system. When setting up traffic control rules, freed memory objects can be accessed by drivers, leading to kernel crashes or potential code execution. This affects any system using Linux with network traffic control features enabled.
Technical details
The vulnerability is a use-after-free in net/sched/cls_api.c affecting the tcf_block_bind() error handler. The root cause is that flow_block_cb instances are added to the driver list by the ndo_setup_tc() callback before tcf_block_bind() validates the operation; if validation fails, the error handler frees these objects while they remain referenced in the driver list. An attacker with network access can trigger this by sending malformed traffic control setup commands via netlink, causing dangling pointer dereference in flow_block_cb_setup_simple(). The fix removes flow_block_cb instances from the driver list before freeing them on error. The vulnerability has been resolved in the Linux kernel.
Affected products
- Linux Linux Kernel 6.3.0-rc6 and earlier (exact affected range varies)
Timeline
- 2025-12-30: disclosed