Linux Kernel Vulnerability: CVE-2026-64530 - Use-After-Free in net/sched/cls_api.c

Executive Summary

A use-after-free vulnerability was discovered in the Linux kernel's net/sched/cls_api.c, specifically in the tcf_qevent_handle function. This vulnerability can be exploited by an attacker to potentially execute arbitrary code or cause a denial-of-service (DoS) condition. Linux kernel versions 5.15.148, 6.1.75, 6.6.14, and 6.7.2 are affected.

Technical Analysis

The vulnerability is caused by the tcf_qevent_handle function not handling the TC_ACT_CONSUMED case properly. When tcf_classify() returns TC_ACT_CONSUMED, the skb is no longer owned by the caller and must not be touched again. However, the tcf_qevent_handle function fell through the switch and returned the skb to the caller as if classification had passed, resulting in a use-after-free (UAF) vulnerability.

How It Gets Exploited

An attacker can exploit this vulnerability by sending a crafted packet that triggers the TC_ACT_CONSUMED case. The attacker would need to have access to the network and be able to send packets to the vulnerable system. The specific action that triggers the vulnerability is when the tcf_classify() function returns TC_ACT_CONSUMED while the skb is held by the defragmentation engine. The attacker gains the ability to potentially execute arbitrary code or cause a denial-of-service (DoS) condition.

Impact Assessment

The vulnerability affects Linux kernel versions 5.15.148, 6.1.75, 6.6.14, and 6.7.2. An attacker can potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The CVSS score for this vulnerability is not provided.

Recommended Actions

To mitigate this vulnerability, update the Linux kernel to version 5.15.212 or later, 6.1.178 or later, 6.6.145 or later, or 6.8 or later. Additionally, implement network segmentation and access controls to limit the attack surface.

Sources

- National Vulnerability Database (NVD)