CVE-2026-46319: Linux Kernel act_ct Use-After-Free Privilege Escalation

Technical summary

The vulnerability is a use-after-free (CWE-416) in the Linux kernel's net/sched/act_ct module, specifically in the interaction between tcf_ct_flow_table_get() and tcf_ct_flow_table_cleanup_work(). The root cause is a race condition between two RCU-protected operations: rhashtable_lookup_fast() internally releases its RCU read lock before returning the flow table pointer, creating an unprotected window between the lookup and the subsequent refcount_inc_not_zero() call. During this window, a parallel cleanup path initiated by tcf_ct_flow_table_put() can execute tcf_ct_flow_table_cleanup_work(), which deallocates the flow table object via kfree(). If cleanup occurs in this race window, the refcount increment operates on freed memory. The analysis indicates the race window is normally too narrow to trigger reliably, but becomes exploitable under conditions where process scheduling or explicit delays amplify the timing gap.

Business impact

Successful exploitation enables local privilege escalation, allowing an unprivileged user to gain kernel-level code execution. This bypasses access controls and can lead to complete system compromise, data exfiltration, malware persistence, or denial of service. In containerized or shared-tenancy environments, the impact is amplified, as a guest or container user could compromise the host kernel. Organizations running susceptible kernel versions face elevated risk if they operate multi-tenant systems or allow unprivileged user workloads on production infrastructure.

Affected systems

The Linux kernel is affected. Exploitation requires local access and the ability to interact with traffic control (tc) subsystem facilities, typically available to unprivileged users via netlink sockets. Verify the specific affected kernel versions and any distribution-specific backports against the Linux kernel security advisory and your vendor's advisories. Containerized deployments, where unprivileged container processes can invoke tc operations, are at particular risk.

Exploitability

Exploitability is classified as high despite a narrow race window. The vulnerability requires local user-level access and does not require special privileges to trigger initial setup of traffic control policies. The race window is normally microseconds but can be reliably widened through kernel module insertion or crafted timing—the published analysis explicitly demonstrates this via msleep(). No in-the-wild exploitation is confirmed at publication, but the technique is well understood by the researcher community. Automated fuzzing and race condition detection tools are likely to surface this issue in testing pipelines.

Remediation

The core fix requires ensuring the RCU read-side critical section remains active from the lookup until after the reference count is safely incremented. This involves restructuring tcf_ct_flow_table_get() to hold the RCU lock across both the hashtable lookup and the refcount operation, or alternatively, adopting a synchronization mechanism that prevents cleanup during the vulnerable window. Patch details and exact code changes should be verified against the upstream Linux kernel commit and your distributor's advisory, as backport variations exist.

Patch guidance

Linux users should apply kernel updates provided by their distribution or upstream as soon as they become available. Check the Linux kernel security advisories and your vendor's security bulletins for specific patched versions and release dates. If you run a self-compiled kernel, monitor lkml and kernel.org for the upstream fix. In the interim, if feasible, restrict unprivileged access to traffic control operations via userspace policy (e.g., seccomp, AppArmor, or SELinux policies limiting netlink socket access), though this is not a complete mitigation.

Detection guidance

Monitor for attempts to use traffic control (tc) commands or netlink syscalls by unprivileged processes, particularly repeated calls to tcf_ct_init() or manipulation of flow table zones. Kernel logging and BPF-based observability can capture netlink policy change events. Look for kernel warnings, UAF detections via KASAN if enabled, or unexpected kernel panics correlated with tc operations. In production, enable CONFIG_KASAN and CONFIG_KASAN_GENERIC if resources permit, to catch heap corruption at runtime. Audit logs showing tc or netlink activity from unexpected users warrant investigation.

Why prioritize this

This vulnerability earns HIGH priority due to the combination of: (1) local privilege escalation capability affecting kernel integrity, (2) exploitability within reach of unprivileged users without requiring race condition amplification techniques in multi-process or scheduler-friendly scenarios, and (3) broad applicability across Linux distributions and versions. While the race window is narrow, it is deterministically triggerable and well-documented. Organizations with multi-user or containerized systems should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector: Local (AV:L), reflecting that local user access is required; Attack Complexity: Low (AC:L), as the race condition, while timing-sensitive, does not require privilege escalation beforehand or complex environmental setup; Privileges Required: Low (PR:L), as unprivileged users can invoke tc operations; User Interaction: None (UI:N); Scope: Unchanged (S:U); Confidentiality, Integrity, and Availability all High (C:H/I:H/A:H), because successful exploitation yields kernel code execution with full system access, enabling data theft, unauthorized modification, and denial of service.

Frequently asked questions