CVE-2026-46319

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: Only release RCU read lock after ct_ft

When looking up a flow table in act_ct in tcf_ct_flow_table_get(),

rhashtable_lookup_fast() internally opens and closes an RCU read critical

section before returning ct_ft.

The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()

is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft

object. This vulnerability can lead to privilege escalation.

Analysis from [email protected]:

When initializing act_ct, tcf_ct_init() is called, which internally triggers

tcf_ct_flow_table_get().

static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)

{

struct zones_ht_key key = { .net = net, .zone = params->zone };

struct tcf_ct_flow_table *ct_ft;

int err = -ENOMEM;

mutex_lock(&zones_mutex);

ct_ft = rhashtable_loo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References