PT-2026-64797 · Linux · Linux
CVE-2026-64530
·
Published
2026-07-26
·
Updated
2026-07-26
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls api: Handle TC ACT CONSUMED in tcf qevent handle
tcf classify() can return TC ACT CONSUMED while the skb is held by the
defragmentation engine (e.g. act ct on out-of-order fragments). When
that happens the skb is no longer owned by the caller and must not be
touched again.
tcf qevent handle() did not handle TC ACT CONSUMED: it fell through the
switch and returned the skb to the caller as if classification had
passed. The only qdisc that wires up qevents today is RED, via three call sites
(qe mark on RED PROB MARK/HARD MARK, qe early drop on congestion drop)
red enqueue() was continuing to operate on an skb it no longer owns in this
case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.
tc qdisc add dev eth0 root handle 1: red ... qevent early drop block 10
tc filter add block 10 ... action ct
(with ct defrag enabled and traffic that produces out-of-order
fragments, e.g. a fragmented UDP stream)
Handle TC ACT CONSUMED in tcf qevent handle() the same way the ingress
and egress fast paths do: treat it as stolen and return NULL without
touching the skb. Unlike the TC ACT STOLEN case, the skb must not be
dropped/freed here, as it is no longer owned by us.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux