PT-2026-64797 · Linux · Linux
CVE-2026-64530
·
Publicado
2026-07-26
·
Atualizado
2026-07-26
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls api: Handle TC ACT CONSUMED in tcf qevent handle
tcf classify() can return TC ACT CONSUMED while the skb is held by the
defragmentation engine (e.g. act ct on out-of-order fragments). When
that happens the skb is no longer owned by the caller and must not be
touched again.
tcf qevent handle() did not handle TC ACT CONSUMED: it fell through the
switch and returned the skb to the caller as if classification had
passed. The only qdisc that wires up qevents today is RED, via three call sites
(qe mark on RED PROB MARK/HARD MARK, qe early drop on congestion drop)
red enqueue() was continuing to operate on an skb it no longer owns in this
case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.
tc qdisc add dev eth0 root handle 1: red ... qevent early drop block 10
tc filter add block 10 ... action ct
(with ct defrag enabled and traffic that produces out-of-order
fragments, e.g. a fragmented UDP stream)
Handle TC ACT CONSUMED in tcf qevent handle() the same way the ingress
and egress fast paths do: treat it as stolen and return NULL without
touching the skb. Unlike the TC ACT STOLEN case, the skb must not be
dropped/freed here, as it is no longer owned by us.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux