Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the 'taprio' traffic scheduler used for time-sensitive networking. When the system switches between different traffic schedules, it could mistakenly access memory that has already been freed. This type of flaw typically leads to system instability, unpredictable network behavior, or a complete system crash (denial of service).
Technical details
A use-after-free vulnerability exists in net/sched/sch_taprio.c within the advance_sched() function. When should_change_schedules() returns true, the switch_schedules() function promotes an 'admin' schedule to 'oper' and queues the old 'oper' schedule for RCU freeing. However, the 'next' pointer continues to reference an entry from the now-freed old schedule. Subsequent operations, such as setting next->end_time and rcu_assign_pointer, access this freed memory. The fix ensures that the 'next' pointer is updated to the first entry of the new 'oper' schedule immediately after the switch. This issue affects systems utilizing the Time Aware Priority Shaper (taprio) for deterministic networking.
Affected products
- Linux Linux Kernel a3d43c0d56f1b94e74963a2fbadfb70126d92213 to 105425b1969c5affe532713cfac1c0b320d7ac2b
Timeline
- 2026-04-10: disclosed: Vulnerability fix authored
- 2026-06-24: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa
- https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b
- https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a
- https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8
- https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f
- https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7
- https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78