Executive brief
A race condition in the Linux kernel's traffic control (tc) classifier system can lead to a use-after-free memory bug when two filter creation threads operate on the same chain concurrently. An attacker with local access can exploit this to cause a kernel crash or potentially achieve code execution, affecting system availability and stability.
Technical details
The vulnerability exists in net/sched/cls_api.c where a race condition occurs during concurrent filter creation. When two threads call tc_new_tfilter on the same chain, both may find an empty chain and drop the filter_chain_lock. If one thread (e.g., u32) inserts its classifier before the other (e.g., flower), the second thread detects a classifier kind mismatch, takes a reference on the existing classifier via tcf_proto_put(), and releases its own. If both threads reach the errout path, the final tcf_proto_put() can trigger tp->ops->destroy() without holding rtnl_lock, causing a use-after-free. The fix ensures tcf_proto_destroy() acquires rtnl_lock before calling tp->ops->destroy() for locked classifiers when rtnl is not already held. Attack requires local ability to create tc filters via netlink.
Affected products
- Linux Linux kernel affected versions prior to fix (exact versions not specified in advisory)
Timeline
- 2026-08-22: disclosed