CVE-2026-23245
Received Received - Intake
Use-After-Free Vulnerability in Linux Kernel net/sched act_gate

Publication date: 2026-03-18

Last updated on: 2026-04-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits the entry list, preserve the existing schedule so the effective state is unchanged.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-04-18
Generated
2026-05-07
AI Q&A
2026-03-18
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's network scheduler component, specifically in the act_gate module. The issue arises because the gate action can be replaced while a high-resolution timer callback or a dump path is traversing the schedule list. This can lead to inconsistencies or race conditions.

The fix involves converting the parameters to an RCU (Read-Copy-Update) protected snapshot and performing updates under a lock (tcf_lock), ensuring that the previous snapshot is freed safely using call_rcu(). Additionally, when the REPLACE operation omits the entry list, the existing schedule is preserved to maintain the effective state unchanged.


How can this vulnerability impact me? :

I don't know


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


What immediate steps should I take to mitigate this vulnerability?

I don't know


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart