CVE-2026-23413
Received Received - Intake
Use-After-Free in Linux Kernel clsact Qdisc Causes Memory Corruption

Publication date: 2026-04-02

Last updated on: 2026-04-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a replacement failure for the new clsact qdisc instance. clsact_init() initializes ingress first and then takes care of the egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon failure, the kernel will trigger the clsact_destroy() callback. Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the way how the transition is happening. If tcf_block_get_ext on the q->ingress_block ends up failing, we took the tcx_miniq_inc reference count on the ingress side, but not yet on the egress side. clsact_destroy() tests whether the {ingress,egress}_entry was non-NULL. However, even in midway failure on the replacement, both are in fact non-NULL with a valid egress_entry from the previous clsact instance. What we really need to test for is whether the qdisc instance-specific ingress or egress side previously got initialized. This adds a small helper for checking the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon clsact_destroy() in order to fix the use-after-free scenario. Convert the ingress_destroy() side as well so both are consistent to each other.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-02
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-02
EPSS Evaluated
2026-06-14
NVD
CVE-2026-23413
EUVD
EUVD-2026-18192
Affected Vendors & Products
Showing 13 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.10
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.20 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.10 (exc)
linux linux_kernel From 6.10.1 (inc) to 6.12.78 (exc)
linux linux_kernel From 6.6.41 (inc) to 6.6.130 (exc)
linux linux_kernel From 6.9.10 (inc) to 6.10 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's clsact qdisc component. It occurs during the initialization and destruction rollback process when replacing a clsact instance. Specifically, if the initialization of the new clsact qdisc instance fails partway through (for example, during the ingress initialization), the kernel triggers a destroy callback. However, due to improper checks, the destroy function may access memory that has already been freed, leading to a use-after-free condition.

The root cause is that the destroy function tests whether ingress and egress entries are non-NULL, but these entries may still be non-NULL from the previous instance even if the new instance's ingress or egress sides were not fully initialized. The fix involves adding a helper to check whether the ingress or egress sides were actually initialized before attempting to destroy them, preventing the use-after-free.

Impact Analysis

A use-after-free vulnerability in the kernel can lead to undefined behavior, including system crashes, memory corruption, or potential escalation of privileges if exploited. Since this issue occurs in the clsact qdisc, which is related to network traffic control, it could potentially be triggered by manipulating network configurations or traffic control settings.

Exploitation of this vulnerability might allow an attacker to cause denial of service by crashing the kernel or, in some cases, execute arbitrary code with kernel privileges, depending on the system and exploit complexity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart