CVE-2026-53264 - Vulnerability Details

- net/sched: act_api: use RCU with deferred freeing for action lifecycle

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: use RCU with deferred freeing for action lifecycle

When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.

Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:

0: mutex_lock() <-- holds the idr lock
0: rcu_read_lock()
0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)
0: mutex_unlock() <-- releases the idr lock
1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
1: idr_remove(idr, index) <-- Action removed from IDR
1: mutex_unlock() <-- mutex released allowing us to delete the action
1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral
0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory

This patch fixes the race condition between NEWTFILTER and DELFILTER by
adding struct rcu_head to tc_action used in the deferral and introducing a
call_rcu() in the delete path to defer the final kfree().

Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu")
but also modernization/simplification to directly use kfree_rcu().

Let's illustrate the new restored code path:

0: rcu_read_lock()
1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
1: idr_remove(idr, index)
1: mutex_unlock()
1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period
0: p = idr_find(idr, index)
0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0
1: rcu_read_unlock() <-- release so freeing can run after grace period

After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.

Published: 2026-06-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel traffic‑control subsystem permits a use‑after‑free bug when a filter action is created and deleted concurrently. The flaw arises because the action's memory is freed immediately after removal, while a second CPU may still hold a stale reference. This can corrupt kernel memory and potentially lead to a crash or privilege escalation, representing a typical use‑after‑free vulnerability (CWE‑364).

Affected Systems

The flaw resides in the generic traffic‑control (tc) core code of the Linux kernel. All kernel releases that ship with the tc subsystem and have not incorporated the RCU‑deferral patch are vulnerable. This includes kernels used by most Linux distributions unless they have applied the downstream patch from commit d7fb60b9.

Risk and Exploitability

The CVSS base score is 7.8 and the EPSS indicates a very low public exploitation probability (<1 %). The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploitation has been observed. The attack requires the ability to add or delete traffic‑control filters, meaning the attacker must have local or privileged access. The resulting kernel memory corruption could cause a system crash or, if an attacker can trigger privileged code execution, compromise system integrity. Overall, the risk level is moderate for environments that use tc filtering.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 98b2e40879abf0245be5a5b7af69e0f6ff524ac3
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 18af5d2ef0c4f65787fd1280c8b23286b9f2a835
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 1f1b98fea6b9ea30507d0f2fbff6750292d097e2
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 8b136f18ac4b2ace5aaad3305b3f8a5d8165a009
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 5dd51e09020c65aa53cf128e5e3517cd53b3c113
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< b60e9391142e983fab2be53497aa8f71fdd09cd5
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 91d105d2cbe002f9c7b43a6183adedc37e1da1f7
`d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da`	affected	< 5057e1aca011e51ef51498c940ef96f3d3e8a305

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,98b2e40879abf0245be5a5b7af69e0f6ff524ac3)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,18af5d2ef0c4f65787fd1280c8b23286b9f2a835)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,1f1b98fea6b9ea30507d0f2fbff6750292d097e2)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,8b136f18ac4b2ace5aaad3305b3f8a5d8165a009)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,5dd51e09020c65aa53cf128e5e3517cd53b3c113)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,b60e9391142e983fab2be53497aa8f71fdd09cd5)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,91d105d2cbe002f9c7b43a6183adedc37e1da1f7)`	affected	code_commit	—
`[d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da,5057e1aca011e51ef51498c940ef96f3d3e8a305)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	generic	—
`[0,4.14)`	unaffected	semver	—
`[5.10.259,6.0.0)`	unaffected	semver	—
`[5.15.210,6.0.0)`	unaffected	semver	—
`[6.1.176,7.0.0)`	unaffected	semver	—
`[6.6.143,7.0.0)`	unaffected	semver	—
`[6.12.94,7.0.0)`	unaffected	semver	—
`[6.18.36,7.0.0)`	unaffected	semver	—
`[7.0.13,8.0.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the RCU‑deferral commit for tc action freeing
Reboot or reload the kernel to activate the updated code
If traffic‑control filtering is unnecessary, disable or unload the tc module to eliminate the vulnerable code path

Generated by OpenCVE AI on June 28, 2026 at 15:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835
https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2
https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305
https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113
https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009
https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7
https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3
https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5
https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53264
https://www.cve.org/CVERecord?id=CVE-2026-53264

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53264 https://www.cve.org/CVERecord?id=CVE-2026-53264
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.
Title		net/sched: act_api: use RCU with deferred freeing for action lifecycle
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835 https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2 https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305 https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113 https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009 https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7 https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3 https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:51.870Z

Updated: 2026-06-28T06:41:06.689Z

Reserved: 2026-06-09T07:44:35.395Z

Link: CVE-2026-53264

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53264 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T15:15:05Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object