CVE-2026-23413clsact: Fix use-after-free in init/destroy rollback asymmetry
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a replacement failure for the new clsact qdisc instance. clsact_init() initializes ingress first and then takes care of the egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon failure, the kernel will trigger the clsact_destroy() callback. Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the way how the transition is happening. If tcf_block_get_ext on the q->ingress_block ends up failing, we took the tcx_miniq_inc reference count on the ingress side, but not yet on the egress side. clsact_destroy() tests whether the {ingress,egress}_entry was non-NULL. However, even in midway failure on the replacement, both are in fact non-NULL with a valid egress_entry from the previous clsact instance. What we really need to test for is whether the qdisc instance-specific ingress or egress side previously got initialized. This adds a small helper for checking the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon clsact_destroy() in order to fix the use-after-free scenario. Convert the ingress_destroy() side as well so both are consistent to each other.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 230bb13650b0f186f540500fd5f5f7096a822a2a before a73d95b57bf9faebdfed591bcb7ed9292062a84c; from 1cb6f0bae50441f4b4b32a28315853b279c7404e before 37bef86e5428d59f70a4da82b80f9a8f252fecbe; from 1cb6f0bae50441f4b4b32a28315853b279c7404e before 4c9af67f99aa3e51b522c54968ab3ac8272be41c; from 1cb6f0bae50441f4b4b32a28315853b279c7404e before 0509b762bc5e8ea7b8391130730c6d8502fc6e69; from 1cb6f0bae50441f4b4b32a28315853b279c7404e before a0671125d4f55e1e98d9bde8a0b671941987e208; f61ecf1bd5b562ebfd7d430ccb31619857e80857; from 6.6.41 before 6.6.130; from 6.9.10 before 6.10 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.6.41 before 6.6.130; from 6.9.10 before 6.10; from 6.10.1 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 6.10; 7.0; 7.0; and 5 more ranges | NVD |
References
- https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84cpatch
- https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbepatch
- https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41cpatch
- https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69patch
- https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.