Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the 'gate' action used for traffic scheduling. This flaw could allow a local user to cause a system crash or potentially gain unauthorized access to sensitive information by triggering a race condition when network traffic rules are updated. The issue affects the stability and security of systems utilizing advanced Quality of Service (QoS) features.
Technical details
A race condition exists in the net/sched: act_gate component of the Linux kernel. The vulnerability occurs because the gate action's schedule list can be modified (replaced) while it is simultaneously being accessed by an hrtimer callback or a dump path. This lack of proper synchronization can lead to use-after-free or null pointer dereference scenarios. The fix involves converting the parameters to an RCU-protected snapshot and ensuring updates are swapped under tcf_lock, with previous snapshots freed via call_rcu(). An attacker with local access could exploit this to cause a kernel panic or achieve arbitrary code execution.
Affected products
- Linux Linux kernel 5.8.1 to 5.10.253, 5.11 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.18, 6.19 to 6.19.8
Timeline
- 2026-03-18: advisory: Initial disclosure of CVE-2026-23245
- 2026-03-25: patched: Fix committed to Linux stable tree
References
- https://git.kernel.org/stable/c/035d0d09d5ab3ed3e93d18cde2b562a6719eea23
- https://git.kernel.org/stable/c/04d75529dc0f9be78786162ebab7424af4644df2
- https://git.kernel.org/stable/c/58b162e318d0243ad2d7d92456c0873f2494c351
- https://git.kernel.org/stable/c/62413a9c3cb183afb9bb6e94dd68caf4e4145f4c
- https://git.kernel.org/stable/c/8b1251bbf0f10ac745ed74bad4d3b433caa1eeae
- https://git.kernel.org/stable/c/dfc314d7c767e350f78a46a8f8b134f80e8ad432
- https://git.kernel.org/stable/c/fc98fd8d214693be91253d9a88cdf8e5e143d124