CVE-2026-23245
Analyzed Analyzed - Analysis Complete
Use-After-Free Vulnerability in Linux Kernel net/sched act_gate

Publication date: 2026-03-18

Last updated on: 2026-05-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits the entry list, preserve the existing schedule so the effective state is unchanged.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-05-21
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23245
EUVD
EUVD-2026-12808
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
linux linux_kernel 5.8
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.78 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.18 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.8 (exc)
linux linux_kernel From 5.8.1 (inc) to 5.10.253 (exc)
linux linux_kernel From 5.11 (inc) to 6.1.167 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's network scheduler component, specifically in the act_gate module. The issue arises because the gate action can be replaced while a high-resolution timer callback or a dump path is traversing the schedule list. This can lead to inconsistencies or race conditions.

The fix involves converting the parameters to an RCU (Read-Copy-Update) protected snapshot and performing updates under a lock (tcf_lock), ensuring that the previous snapshot is freed safely using call_rcu(). Additionally, when the REPLACE operation omits the entry list, the existing schedule is preserved to maintain the effective state unchanged.

Impact Analysis

I don't know

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart