CVE-2026-53264
published 2026-06-25CVE-2026-53264: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: use RCU with deferred freeing for action lifecycle
When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.
Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:
0: mutex_lock() 0, mutex held
1: idr_remove(idr, index) tcfa_refcnt) 0, mutex held
1: idr_remove(idr, index)
1: mutex_unlock()
1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) tcfa_refcnt) <-- fails, refcnt already 0
1: rcu_read_unlock() <-- release so freeing can run after grace period
After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 98b2e40879abf0245be5a5b7af69e0f6ff524ac3 | 98b2e40879abf0245be5a5b7af69e0f6ff524ac3 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 18af5d2ef0c4f65787fd1280c8b23286b9f2a835 | 18af5d2ef0c4f65787fd1280c8b23286b9f2a835 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 1f1b98fea6b9ea30507d0f2fbff6750292d097e2 | 1f1b98fea6b9ea30507d0f2fbff6750292d097e2 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 8b136f18ac4b2ace5aaad3305b3f8a5d8165a009 | 8b136f18ac4b2ace5aaad3305b3f8a5d8165a009 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 5dd51e09020c65aa53cf128e5e3517cd53b3c113 | 5dd51e09020c65aa53cf128e5e3517cd53b3c113 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < b60e9391142e983fab2be53497aa8f71fdd09cd5 | b60e9391142e983fab2be53497aa8f71fdd09cd5 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 91d105d2cbe002f9c7b43a6183adedc37e1da1f7 | 91d105d2cbe002f9c7b43a6183adedc37e1da1f7 |
| linux | linux | >= d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da < 5057e1aca011e51ef51498c940ef96f3d3e8a305 | 5057e1aca011e51ef51498c940ef96f3d3e8a305 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.14 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is po
ghsa_unreviewed·2026-06-25
CVE-2026-53264 In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is po
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: use RCU with deferred freeing for action lifecycle
When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.
Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:
0: mutex_lock() 0, mutex held
1: idr_remove(idr, index) tcfa_refcnt) 0, mutex held
1: idr_remove(idr, index)
1: mutex_unlock()
1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) tcfa_refcnt) <-- fails, refcnt already 0
1: rcu_read_unlock() <-- release so freeing can run after grace period
After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate
Red Hat
kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle
vendor_redhat·2026-06-25·CVSS 7.0
CVE-2026-53264 [MEDIUM] CWE-364 kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle
kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle
A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released. This could potentially allow an attacker to cause system instability or execute arbitrary code.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5
2026-06-25
Published