CVE-2026-64530
Received Received - Intake

Use-After-Free in Linux Kernel Traffic Control

Publication date: 2026-07-26

Last updated on: 2026-07-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop) red_enqueue() was continuing to operate on an skb it no longer owns in this case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF. tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10 tc filter add block 10 ... action ct (with ct defrag enabled and traffic that produces out-of-order fragments, e.g. a fragmented UDP stream) Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress and egress fast paths do: treat it as stolen and return NULL without touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be dropped/freed here, as it is no longer owned by us.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-26
Last Modified
2026-07-26
Generated
2026-07-26
AI Q&A
2026-07-26
EPSS Evaluated
N/A
NVD
CVE-2026-64530
EUVD
EUVD-2026-49051

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs in the traffic control classification system. When a packet is classified, the function tcf_qevent_handle() fails to properly handle the TC_ACT_CONSUMED return value. This leads to the kernel attempting to use a packet it no longer owns, resulting in a use-after-free (UAF) condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's traffic control (tc) subsystem and involves improper handling of TC_ACT_CONSUMED in qevents. Detection requires checking kernel logs for crashes or unexpected behavior related to RED qdisc with qevents and connection tracking (ct) actions. Monitor for kernel oops or panics during fragmented traffic processing.

Impact Analysis

This vulnerability can cause system crashes, data corruption, or privilege escalation if exploited. Attackers could trigger the UAF by sending specially crafted network traffic, leading to denial-of-service or potential arbitrary code execution on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel memory management issue unrelated to data protection or privacy controls.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch the vulnerability. If immediate patching is not possible, disable RED qdisc with qevents or remove any tc filters using block-based qevents with ct actions. Avoid using fragmented UDP traffic with connection tracking until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64530. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart