CVE-2026-68138

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: serialize qdisc_rtab_list against concurrent get/put

qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly

linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no

lock. This was only safe because every caller historically held the RTNL

mutex, which serialized all rate-table lookups, inserts and frees.

That invariant no longer holds. cls_flower sets

TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false

for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through

tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() ->

tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the

RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each

adding a flower filter with a police action carrying the same rate, then

race on qdisc_rtab_list and on the non-atomic refcnt, leading to a

use-after-free / double-free of the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References