CVE-2026-23270

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23270
In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189 Patch
https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 Patch
https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e Patch
https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828 Patch
https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4 Patch
https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0 Patch
https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
History

22 May 2026, 18:24

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-416
References () https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189 - () https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189 - Patch
References () https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 - () https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 - Patch
References () https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e - () https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e - Patch
References () https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828 - () https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828 - Patch
References () https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4 - () https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4 - Patch
References () https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0 - () https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0 - Patch
References () https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1 - () https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1 - Patch
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0 -

02 Apr 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

25 Mar 2026, 11:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828 -
  • () https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1 -
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net/sched: Solo permitir que act_ct se vincule a qdiscs clsact/de entrada y bloques compartidos Como Paolo dijo anteriormente [1]: 'Desde el commit culpado a continuación, classify puede devolver TC_ACT_CONSUMED mientras el skb actual está siendo retenido por el motor de desfragmentación. Según lo informado por GangMin Kim, si dicho paquete es uno que puede causar un UaF cuando el motor de desfragmentación más tarde intente tocar de nuevo dicho paquete.' act_ct nunca estuvo destinado a ser usado en la ruta de salida, sin embargo, algunos usuarios lo están adjuntando a la salida hoy [2]. Intentando llegar a un punto intermedio, notamos que, mientras que la mayoría de los qdiscs no están manejando TC_ACT_CONSUMED, los qdiscs clsact/de entrada sí lo están. Con eso en mente, abordamos el problema permitiendo solo que act_ct se vincule a qdiscs clsact/de entrada y bloques compartidos. De esa manera, todavía es posible adjuntar act_ct a la salida (aunque solo con clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/

18 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 18:16

Updated : 2026-05-22 18:24

NVD link : CVE-2026-23270

Mitre link : CVE-2026-23270

CVE.ORG link : CVE-2026-23270

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free