CVE-2026-53264: Linux Kernel Use-After-Free in Traffic Control Actions

Technical summary

CVE-2026-53264 is a use-after-free (CWE-416) in net/sched/act_api.c triggered by concurrent NEWTFILTER and DELFILTER netlink operations. The vulnerability arises from a missing synchronization mechanism between action object lifecycle and RCU read-side critical sections. Specifically: (1) CPU0 holds an RCU read lock and retrieves an action via idr_find(), (2) CPU1 decrements the action's refcount to zero, removes it from the IDR tree, and immediately calls kfree(), (3) CPU0 attempts refcount_inc_not_zero() on the freed object, causing UAF. The patch reintroduces deferred freeing via call_rcu() and kfree_rcu(), ensuring the object remains valid until the RCU grace period expires, after which idr_find() on other CPUs will safely return NULL. This is a functional revert of commit d7fb60b9cafb combined with modern RCU primitives.

Business impact

Successful exploitation requires local access and the ability to execute network configuration commands with standard user privileges. An attacker could trigger kernel memory corruption, potentially leading to denial of service, information disclosure of kernel memory, or privilege escalation. The impact is primarily relevant to multi-user systems and containerized environments where unprivileged users can modify network filters. Systems with network namespace isolation or strict AppArmor/SELinux policies limiting unprivileged tc(8) access face reduced risk.

Affected systems

The Linux kernel is affected, specifically versions with active traffic control action management. The vulnerability requires that the kernel be built with network traffic control (netfilter/tc) support enabled. Embedded systems, cloud VMs, and traditional servers running Linux distributions are in scope. The provided CVE references show the impact spans multiple kernel releases. Verify your specific kernel version against the vendor advisory to confirm inclusion of the vulnerable code path and availability of patched releases.

Exploitability

Exploitation is classified HIGH due to low attack complexity and low privilege requirement (standard user can call tc commands). An attacker must: (1) have local login access, (2) be able to execute netlink traffic control operations (not restricted by capabilities or policies), and (3) successfully trigger the race condition, which may require multiple attempts or specific timing. No public exploit code is known at this time, and the vulnerability is not tracked as actively exploited. Practical exploitation is feasible but non-trivial; the race window is small and timing-dependent.

Remediation

Apply the kernel patch that restores RCU-based deferred freeing in the action cleanup path. This involves adding an rcu_head structure to the tc_action object and replacing immediate kfree() calls with call_rcu() or kfree_rcu() in the action deletion handler. Verify the patched kernel version against your vendor's security advisory to confirm the fix is included. Until patching is complete, restrict unprivileged access to tc(8) and netlink TC operations via Linux capabilities, AppArmor, or SELinux policies if your deployment allows it.

Patch guidance

Contact your Linux distribution's security team or kernel maintainers for backported patches targeting your specific kernel version series. Upstream patches are typically merged into -rc and stable kernels shortly after disclosure. For distributions with extended support (RHEL, Ubuntu LTS, Debian), expect security advisory releases with patched kernel packages. Test patches in non-production environments first, as kernel updates require reboot. If your distribution has not yet released a patch, consider disabling unprivileged network filter operations as a temporary mitigation.

Detection guidance

Monitor system logs for unusual traffic control configuration changes (tc commands) issued by unprivileged users. Look for patterns of rapid NEWTFILTER and DELFILTER operations on the same interface. Kernel oops or UAF-related messages ("BUG: unable to handle page fault for address" with act_api.c in the call stack) may indicate exploitation attempts. Runtime kernel address sanitizer (KASAN) builds will reliably catch UAF at runtime. Security tools like audit(8) can log netlink TC_QDISC_NEW and TC_QDISC_DEL events; correlate these with user context to identify suspicious activity.

Why prioritize this

This vulnerability merits prompt patching due to the combination of: (1) HIGH CVSS (7.8) reflecting local privilege escalation potential, (2) straightforward attack surface (standard unprivileged user can trigger the race), and (3) kernel-level impact (memory corruption leading to DoS or privilege escalation). It is not currently exploited in the wild (KEV status: false), providing a window for proactive patching before threat actors develop reliable weaponized exploits. Prioritize systems where unprivileged users have direct access and network configuration privileges.

Risk score, explained

CVSS 7.8 (HIGH) derives from: AV:L (local attack vector—requires login access), AC:L (low complexity—race condition is deterministic with effort), PR:L (low privilege—standard unprivileged user can execute tc commands), UI:N (no user interaction required), S:U (impact limited to the host), and C:H/I:H/A:H (high confidentiality, integrity, and availability impact via kernel memory corruption). The score appropriately reflects the serious but localized threat; the vulnerability does not remotely compromise systems or affect confidentiality of data in transit.

Frequently asked questions