CVE-2026-53264

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel's Netfilter Action API

Publication date: 2026-06-25

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-08

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53264

EUVD

EUVD-2026-39215

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 4.14 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's network scheduler, specifically in the handling of actions during concurrent execution of NEWTFILTER and DELFILTER operations.

When these two operations run at the same time on different CPUs, a race condition can occur where an action is freed (deleted) while another CPU still holds a reference to it. This leads to a use-after-free (UAF) situation, where the system tries to access memory that has already been freed.

The vulnerability arises because the deletion path immediately frees the action's memory without deferring it, causing the stale pointer to point to invalid memory.

The fix involves using Read-Copy-Update (RCU) mechanisms to defer the freeing of the action's memory until it is safe, preventing the use-after-free condition by ensuring that no CPU can access the freed memory prematurely.

Impact Analysis

This vulnerability can lead to use-after-free conditions in the Linux kernel's network scheduler, which may cause system instability, crashes, or potential kernel memory corruption.

Exploitation of this race condition could allow an attacker with the ability to trigger NEWTFILTER and DELFILTER operations concurrently to cause denial of service or potentially escalate privileges by corrupting kernel memory.

Mitigation Strategies

The vulnerability is resolved by applying a patch to the Linux kernel that fixes the race condition between NEWTFILTER and DELFILTER by using RCU with deferred freeing for the action lifecycle.

Immediate mitigation involves updating the Linux kernel to a version that includes this fix, which adds a call_rcu() in the delete path to defer the final kfree() and prevent use-after-free conditions.

Hi! I’m here to help you understand CVE-2026-53264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70