CVE-2026-23413
Use-After-Free in Linux Kernel clsact Qdisc Causes Memory Corruption
Publication date: 2026-04-02
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.10 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 6.10.1 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 6.6.41 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.9.10 (inc) to 6.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's clsact qdisc component. It occurs during the initialization and destruction rollback process when replacing a clsact instance. Specifically, if the initialization of the new clsact qdisc instance fails partway through (for example, during the ingress initialization), the kernel triggers a destroy callback. However, due to improper checks, the destroy function may access memory that has already been freed, leading to a use-after-free condition.
The root cause is that the destroy function tests whether ingress and egress entries are non-NULL, but these entries may still be non-NULL from the previous instance even if the new instance's ingress or egress sides were not fully initialized. The fix involves adding a helper to check whether the ingress or egress sides were actually initialized before attempting to destroy them, preventing the use-after-free.
How can this vulnerability impact me? :
A use-after-free vulnerability in the kernel can lead to undefined behavior, including system crashes, memory corruption, or potential escalation of privileges if exploited. Since this issue occurs in the clsact qdisc, which is related to network traffic control, it could potentially be triggered by manipulating network configurations or traffic control settings.
Exploitation of this vulnerability might allow an attacker to cause denial of service by crashing the kernel or, in some cases, execute arbitrary code with kernel privileges, depending on the system and exploit complexity.