CVE-2026-99167
Linux: net/sched: fix use-after-free in __tcf_action_put()
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2465d27ef90de9105c2bffb6c35f8ce08918e642Also 2e012e431aa271ef3c84206f48854f539c03bff0, 7b16eb911091aae237a8673da94e4dfb9cd21d54CVE List
What fixes it
- 2465d27ef90de9105c2bffb6c35f8ce08918e642LinuxCVE List
- 2e012e431aa271ef3c84206f48854f539c03bff0LinuxCVE List
- 7b16eb911091aae237a8673da94e4dfb9cd21d54LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix use-after-free in __tcf_action_put()
__tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as:
BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64
Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
Text from CVE List
Affected versions 8
- Linuxaffected: 16af6067392c40e454e49eec834843ab03643d96 before 2465d27ef90de9105c2bffb6c35f8ce08918e642CVE List
- Linuxaffected: 16af6067392c40e454e49eec834843ab03643d96 before 2e012e431aa271ef3c84206f48854f539c03bff0CVE List
- Linuxaffected: 16af6067392c40e454e49eec834843ab03643d96 before 7b16eb911091aae237a8673da94e4dfb9cd21d54CVE List
- Linuxaffected: 4.19CVE List
- Linuxunaffected: all versions before 4.19CVE List
- Linuxunaffected: 6.18.59 through 6.18.*CVE List
- Linuxunaffected: 7.2.13 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List