Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:30.147Z",
  "pubdate": "2026-09-25T11:17:30.147Z",
  "executiveSummary": "This vulnerability involves a Use-After-Free (UAF) condition within the Linux kernel networking subsystem, specifically during the initialization of queuing disciplines (qdisc).\nThe issue stems from improper synchronization when handling failed RTM_NEWQDISC requests, where a qdisc object is freed while still accessible to lockless readers.\nThis flaw affects the net/sched component of the Linux kernel, exposing a race condition that could lead to kernel memory corruption, system crashes, or potential arbitrary code execution.\nSuccessful exploitation requires the ability to trigger a specific sequence of network configuration operations, typically necessitating local user privileges to interface with Netlink sockets.\nThe vulnerability allows an attacker to exploit a race window between the invalidation of a qdisc pointer and the final cleanup of the structure.\nThe risk is categorized as high due to the potential for kernel-level memory manipulation, making reliable service disruption or privilege escalation a viable threat for local attackers.",
  "technicalDetails": "The root cause of this vulnerability lies in the lifecycle management of qdisc structures within the net/sched subsystem. When an RTM_NEWQDISC request is issued, the clsact qdisc may bind a shared ingress block during the ->init() callback. This process publishes an embedded mini_Qdisc pointer that is accessible to lockless readers (such as the packet processing path in tc_run()).\nIf the RTM_NEWQDISC request includes an invalid TCA_RATE attribute, the estimator setup fails subsequent to the successful ->init() call. The kernel's current unwind logic incorrectly handles this scenario: while it removes the qdisc pointer from the lookup structures, it proceeds to synchronously free the underlying qdisc memory. This creates a critical race condition because the tc_run() function or other lockless readers might still be referencing the qdisc structure that has been deallocated.\nThe attack flow proceeds as follows: 1) An attacker initiates a Netlink request to create a qdisc (e.g., clsact) that is intentionally malformed to trigger an estimator setup failure. 2) The kernel executes ->init(), which successfully publishes the mini_Qdisc structure to readers. 3) The estimator setup fails, triggering the error path. 4) The error path invokes a synchronous free of the qdisc. 5) If a packet is concurrently being processed, tc_run() attempts to access the now-freed memory pointer, leading to a Use-After-Free condition.\nThe vulnerability occurs within net/sched and affects kernel configurations utilizing traffic control ingress filtering. Because the memory is freed synchronously while references may still be active in the read-side critical section, the kernel encounters an invalid memory access. Post-exploitation, an attacker can manipulate heap allocations to replace the freed object, potentially hijacking execution flow or causing a kernel panic, thereby achieving a Denial of Service (DoS) or privilege escalation depending on the environment's memory layout and attacker capabilities."
}