Executive brief
A race condition was identified in the Linux kernel's network scheduling component. This flaw could allow a local attacker to trigger a 'use-after-free' error by simultaneously creating and deleting network filters. In practice, this could lead to system instability, crashes, or potentially unauthorized access to kernel memory.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's net/sched act_api due to improper lifecycle management of actions. When NEWTFILTER and DELFILTER are run concurrently, a race condition occurs where one CPU can find an action in the IDR while another CPU decrements the reference count to zero and immediately frees the memory using kfree() without waiting for an RCU grace period. This allows the first CPU to attempt to increment the reference count on already freed memory. The fix involves restoring RCU-deferred freeing by adding a struct rcu_head to tc_action and utilizing kfree_rcu() to ensure memory is not reclaimed until all RCU readers have finished.
Affected products
- Linux Linux Kernel versions prior to fixed stable releases in June 2026
Timeline
- 2026-05-31: other: Patch authored by Jamal Hadi Salim
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835
- https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2
- https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305
- https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113
- https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009
- https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7
- https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3