CVE-2026-23413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23413", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.014Z", "datePublished": "2026-04-02T11:40:54.384Z", "dateUpdated": "2026-10-19T18:35:42.855Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:33.571Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclsact: Fix use-after-free in init/destroy rollback asymmetry\n\nFix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.\nThe latter is achieved by first fully initializing a clsact instance, and\nthen in a second step having a replacement failure for the new clsact qdisc\ninstance. clsact_init() initializes ingress first and then takes care of the\negress part. This can fail midway, for example, via tcf_block_get_ext(). Upon\nfailure, the kernel will trigger the clsact_destroy() callback.\n\nCommit 1cb6f0bae504 (\"bpf: Fix too early release of tcx_entry\") details the\nway how the transition is happening. If tcf_block_get_ext on the q->ingress_block\nends up failing, we took the tcx_miniq_inc reference count on the ingress\nside, but not yet on the egress side. clsact_destroy() tests whether the\n{ingress,egress}_entry was non-NULL. However, even in midway failure on the\nreplacement, both are in fact non-NULL with a valid egress_entry from the\nprevious clsact instance.\n\nWhat we really need to test for is whether the qdisc instance-specific ingress\nor egress side previously got initialized. This adds a small helper for checking\nthe miniq initialization called mini_qdisc_pair_inited, and utilizes that upon\nclsact_destroy() in order to fix the use-after-free scenario. Convert the\ningress_destroy() side as well so both are consistent to each other."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `clsact` qdisc init/destroy path is reached through local rtnetlink `RTM_NEWQDISC` traffic, not by remote packets directly.\nAC:L - The failure path is attacker-controlled by creating/replacing `clsact` with shared block indexes so `tcf_block_get_ext()` fails during rollback; no uncontrollable race is required.\nPR:L - `RTM_NEWQDISC` requires `CAP_NET_ADMIN` in the target network namespace, and `tc`/qdisc operations are reachable by an unprivileged user via user+network namespaces.\nUI:N - After local access, exploitation only requires issuing crafted netlink/qdisc operations and does not require victim interaction.\nS:U - The bug is a standard kernel memory corruption issue within the same kernel security authority, not a VM or hardware isolation boundary escape.\nC:H - The bug is a use-after-free of `tcx_entry` state reachable through old `clsact` miniq callbacks, and UAF memory reuse can provide kernel memory disclosure primitives.\nI:H - The stale miniq pointer can lead to writes through freed/reallocated kernel memory, making control-flow or kernel data corruption defensible.\nA:H - The same UAF can be triggered into kernel crashes/oopses during qdisc/filter cleanup or callback paths, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_ingress.c"], "versions": [{"version": "230bb13650b0f186f540500fd5f5f7096a822a2a", "lessThan": "a73d95b57bf9faebdfed591bcb7ed9292062a84c", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "37bef86e5428d59f70a4da82b80f9a8f252fecbe", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "4c9af67f99aa3e51b522c54968ab3ac8272be41c", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "0509b762bc5e8ea7b8391130730c6d8502fc6e69", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "a0671125d4f55e1e98d9bde8a0b671941987e208", "status": "affected", "versionType": "git"}, {"version": "f61ecf1bd5b562ebfd7d430ccb31619857e80857", "status": "affected", "versionType": "git"}, {"version": "6.6.41", "lessThan": "6.6.130", "status": "affected", "versionType": "semver"}, {"version": "6.9.10", "lessThan": "6.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_ingress.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.41", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84c"}, {"url": "https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbe"}, {"url": "https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41c"}, {"url": "https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69"}, {"url": "https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208"}], "title": "clsact: Fix use-after-free in init/destroy rollback asymmetry", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:07:46.676905Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:42.855Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23413", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.014Z", "datePublished": "2026-04-02T11:40:54.384Z", "dateUpdated": "2026-10-19T18:35:42.855Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:33.571Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclsact: Fix use-after-free in init/destroy rollback asymmetry\n\nFix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.\nThe latter is achieved by first fully initializing a clsact instance, and\nthen in a second step having a replacement failure for the new clsact qdisc\ninstance. clsact_init() initializes ingress first and then takes care of the\negress part. This can fail midway, for example, via tcf_block_get_ext(). Upon\nfailure, the kernel will trigger the clsact_destroy() callback.\n\nCommit 1cb6f0bae504 (\"bpf: Fix too early release of tcx_entry\") details the\nway how the transition is happening. If tcf_block_get_ext on the q->ingress_block\nends up failing, we took the tcx_miniq_inc reference count on the ingress\nside, but not yet on the egress side. clsact_destroy() tests whether the\n{ingress,egress}_entry was non-NULL. However, even in midway failure on the\nreplacement, both are in fact non-NULL with a valid egress_entry from the\nprevious clsact instance.\n\nWhat we really need to test for is whether the qdisc instance-specific ingress\nor egress side previously got initialized. This adds a small helper for checking\nthe miniq initialization called mini_qdisc_pair_inited, and utilizes that upon\nclsact_destroy() in order to fix the use-after-free scenario. Convert the\ningress_destroy() side as well so both are consistent to each other."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `clsact` qdisc init/destroy path is reached through local rtnetlink `RTM_NEWQDISC` traffic, not by remote packets directly.\nAC:L - The failure path is attacker-controlled by creating/replacing `clsact` with shared block indexes so `tcf_block_get_ext()` fails during rollback; no uncontrollable race is required.\nPR:L - `RTM_NEWQDISC` requires `CAP_NET_ADMIN` in the target network namespace, and `tc`/qdisc operations are reachable by an unprivileged user via user+network namespaces.\nUI:N - After local access, exploitation only requires issuing crafted netlink/qdisc operations and does not require victim interaction.\nS:U - The bug is a standard kernel memory corruption issue within the same kernel security authority, not a VM or hardware isolation boundary escape.\nC:H - The bug is a use-after-free of `tcx_entry` state reachable through old `clsact` miniq callbacks, and UAF memory reuse can provide kernel memory disclosure primitives.\nI:H - The stale miniq pointer can lead to writes through freed/reallocated kernel memory, making control-flow or kernel data corruption defensible.\nA:H - The same UAF can be triggered into kernel crashes/oopses during qdisc/filter cleanup or callback paths, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_ingress.c"], "versions": [{"version": "230bb13650b0f186f540500fd5f5f7096a822a2a", "lessThan": "a73d95b57bf9faebdfed591bcb7ed9292062a84c", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "37bef86e5428d59f70a4da82b80f9a8f252fecbe", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "4c9af67f99aa3e51b522c54968ab3ac8272be41c", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "0509b762bc5e8ea7b8391130730c6d8502fc6e69", "status": "affected", "versionType": "git"}, {"version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "lessThan": "a0671125d4f55e1e98d9bde8a0b671941987e208", "status": "affected", "versionType": "git"}, {"version": "f61ecf1bd5b562ebfd7d430ccb31619857e80857", "status": "affected", "versionType": "git"}, {"version": "6.6.41", "lessThan": "6.6.130", "status": "affected", "versionType": "semver"}, {"version": "6.9.10", "lessThan": "6.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_ingress.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.41", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84c"}, {"url": "https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbe"}, {"url": "https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41c"}, {"url": "https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69"}, {"url": "https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208"}], "title": "clsact: Fix use-after-free in init/destroy rollback asymmetry", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:07:46.676905Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:07:49.279Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_ingress.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a73d95b57bf9faebdfed591bcb7ed9292062a84c", "status": "affected", "version": "230bb13650b0f186f540500fd5f5f7096a822a2a", "versionType": "git"}, {"lessThan": "37bef86e5428d59f70a4da82b80f9a8f252fecbe", "status": "affected", "version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "versionType": "git"}, {"lessThan": "4c9af67f99aa3e51b522c54968ab3ac8272be41c", "status": "affected", "version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "versionType": "git"}, {"lessThan": "0509b762bc5e8ea7b8391130730c6d8502fc6e69", "status": "affected", "version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "versionType": "git"}, {"lessThan": "a0671125d4f55e1e98d9bde8a0b671941987e208", "status": "affected", "version": "1cb6f0bae50441f4b4b32a28315853b279c7404e", "versionType": "git"}, {"status": "affected", "version": "f61ecf1bd5b562ebfd7d430ccb31619857e80857", "versionType": "git"}, {"lessThan": "6.6.130", "status": "affected", "version": "6.6.41", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.9.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_ingress.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26D3BD9B-33D9-4B3C-9FAA-E5BA5D7900AF", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.6.41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B0E24EE-A06E-497B-BF65-1F0729D0A2C3", "versionEndExcluding": "6.10", "versionStartIncluding": "6.9.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC42FFE4-BBBB-48E5-AD62-DA7FEAD2DD43", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.10.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*", "matchCriteriaId": "9EA80796-744E-45F5-8632-2AB4F7889FCD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclsact: Fix use-after-free in init/destroy rollback asymmetry\n\nFix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.\nThe latter is achieved by first fully initializing a clsact instance, and\nthen in a second step having a replacement failure for the new clsact qdisc\ninstance. clsact_init() initializes ingress first and then takes care of the\negress part. This can fail midway, for example, via tcf_block_get_ext(). Upon\nfailure, the kernel will trigger the clsact_destroy() callback.\n\nCommit 1cb6f0bae504 (\"bpf: Fix too early release of tcx_entry\") details the\nway how the transition is happening. If tcf_block_get_ext on the q->ingress_block\nends up failing, we took the tcx_miniq_inc reference count on the ingress\nside, but not yet on the egress side. clsact_destroy() tests whether the\n{ingress,egress}_entry was non-NULL. However, even in midway failure on the\nreplacement, both are in fact non-NULL with a valid egress_entry from the\nprevious clsact instance.\n\nWhat we really need to test for is whether the qdisc instance-specific ingress\nor egress side previously got initialized. This adds a small helper for checking\nthe miniq initialization called mini_qdisc_pair_inited, and utilizes that upon\nclsact_destroy() in order to fix the use-after-free scenario. Convert the\ningress_destroy() side as well so both are consistent to each other."}], "id": "CVE-2026-23413", "lastModified": "2026-10-19T19:17:47.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23413", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:07:46.676905Z", "version": "2.0.3"}}]}, "published": "2026-04-02T12:16:20.440", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: clsact: Fix use-after-free in init/destroy rollback asymmetry", "id": "2454317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454317"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's clsact qdisc. This use-after-free vulnerability occurs due to an asymmetry in the initialization and destruction rollback process. When a replacement clsact qdisc instance fails during initialization, the destroy callback is triggered without properly de-initializing the ingress or egress sides, leading to the reuse of freed memory. This can result in system instability or a denial of service."], "name": "CVE-2026-23413", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23413\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23413\nhttps://lore.kernel.org/linux-cve-announce/2026040203-CVE-2026-23413-fa13@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[230bb13650b0f186f540500fd5f5f7096a822a2a,a73d95b57bf9faebdfed591bcb7ed9292062a84c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cb6f0bae50441f4b4b32a28315853b279c7404e,37bef86e5428d59f70a4da82b80f9a8f252fecbe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cb6f0bae50441f4b4b32a28315853b279c7404e,4c9af67f99aa3e51b522c54968ab3ac8272be41c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cb6f0bae50441f4b4b32a28315853b279c7404e,0509b762bc5e8ea7b8391130730c6d8502fc6e69)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cb6f0bae50441f4b4b32a28315853b279c7404e,a0671125d4f55e1e98d9bde8a0b671941987e208)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f61ecf1bd5b562ebfd7d430ccb31619857e80857"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T21:53:23.594500+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that includes commit 1cb6f0bae504", "If an immediate update is not possible, disable or remove the clsact qdisc to prevent the fault", "Monitor kernel logs for crashes or anomalies related to traffic control"], "summary": {"action": "Patch", "impact": "Kernel Crash"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds released before the inclusion of commit 1cb6f0bae504 are vulnerable. The CVE data does not specify a version range, so any kernel that does not contain the clsact patch should be considered affected.", "description_and_impact": "The clsact traffic control qdisc contains a use\u2011after\u2011free bug that is triggered when a qdisc instance is only partially initialized and then destroyed during a rollback of a failed replacement. The bug occurs because the destroy callback checks for non\u2011NULL ingress and egress entries, but an incomplete initialization can leave a valid egress entry from a previous instance. Dereferencing this freed memory can cause the kernel to crash, resulting in a denial of service. The weakness is a memory safety issue (CWE\u2011911) and a use\u2011after\u2011free vulnerability (CWE\u2011416).", "risk_and_exploitability": "The CVSS v3 score of 7.8 indicates high severity, and the EPSS score of less than 1\u202f% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack requires an ability to provoke a qdisc initialization failure or to configure traffic control rules, which normally demands elevated privileges; thus remote exploitation is unlikely and the risk is primarily local or privileged."}}}}, "created": "2026-04-02T20:12:50.968426+00:00", "updated": "2026-04-28T22:00:14.142922+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}