CVE-2026-53264
Received Received - Intake
Use-After-Free in Linux Kernel's Netfilter Action API

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53264
EUVD
EUVD-2026-39215
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's network scheduler, specifically in the handling of actions during concurrent execution of NEWTFILTER and DELFILTER operations.

When these two operations run at the same time on different CPUs, a race condition can occur where an action is freed (deleted) while another CPU still holds a reference to it. This leads to a use-after-free (UAF) situation, where the system tries to access memory that has already been freed.

The vulnerability arises because the deletion path immediately frees the action's memory without deferring it, causing the stale pointer to point to invalid memory.

The fix involves using Read-Copy-Update (RCU) mechanisms to defer the freeing of the action's memory until it is safe, preventing the use-after-free condition by ensuring that no CPU can access the freed memory prematurely.

Impact Analysis

This vulnerability can lead to use-after-free conditions in the Linux kernel's network scheduler, which may cause system instability, crashes, or potential kernel memory corruption.

Exploitation of this race condition could allow an attacker with the ability to trigger NEWTFILTER and DELFILTER operations concurrently to cause denial of service or potentially escalate privileges by corrupting kernel memory.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart