CVE-2026-23413 — Improper Update of Reference Count in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 93.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 2
Latest updateApr 3
Description
In the Linux kernel, the following vulnerability has been resolved:
clsact: Fix use-after-free in init/destroy rollback asymmetry
Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.
The latter is achieved by first fully initializing a clsact instance, and
then in a second step having a replacement failure for the new clsact qdisc
instance. clsact_init() initializes ingress first and then takes care of the
egress part. This can fail midway, for example, via tcf_block_…
Affected Packages3 packages
▶CVEListV5linux/linux230bb13650b0f186f540500fd5f5f7096a822a2a — a73d95b57bf9faebdfed591bcb7ed9292062a84c+6
🔴Vulnerability Details
3OSV
▶
OSV▶
CVE-2026-23413: In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free↗2026-04-02
GHSA▶
GHSA-g3fm-vpqw-g4mf: In the Linux kernel, the following vulnerability has been resolved:
clsact: Fix use-after-free in init/destroy rollback asymmetry
Fix a use-after-fr↗2026-04-02