CVE-2026-23413

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

clsact: Fix use-after-free in init/destroy rollback asymmetry

Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.

The latter is achieved by first fully initializing a clsact instance, and

then in a second step having a replacement failure for the new clsact qdisc

instance. clsact_init() initializes ingress first and then takes care of the

egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon

failure, the kernel will trigger the clsact_destroy() callback.

Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the

way how the transition is happening. If tcf_block_get_ext on the q->ingress_block

ends up failing, we took the tcx_miniq_inc reference count on the ingress

side, but not yet on the egress side. clsact_destroy() tests whether the

{ingress,egress}_entry was non-NULL. However, even in midway failure on the

replacement, both are in fact non-NULL

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References