CVE-2026-64530 in Linux
Summary
by MITRE • 07/26/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again.
tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop) red_enqueue() was continuing to operate on an skb it no longer owns in this case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.
tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10 tc filter add block 10 ... action ct
(with ct defrag enabled and traffic that produces out-of-order fragments, e.g. a fragmented UDP stream)
Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress and egress fast paths do: treat it as stolen and return NULL without touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be dropped/freed here, as it is no longer owned by us.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability identified in the Linux kernel's net/sched subsystem represents a critical use-after-free condition that arises from improper handling of packet classification results within the traffic control framework. This flaw specifically affects the tcf_qevent_handle() function which processes queueing events for traffic control filters, creating a scenario where kernel memory corruption can occur through improper skb (socket buffer) management during packet processing.
The technical root cause stems from the mismatch between how tcf_classify() returns TC_ACT_CONSUMED values and how tcf_qevent_handle() processes these return codes. When packet classification occurs on fragments that are being defragmented by the conntrack subsystem, particularly in out-of-order scenarios, the function may return TC_ACT_CONSUMED indicating that the packet has been consumed by the classifier. However, unlike other kernel paths that properly handle this return code by treating it as a stolen packet, tcf_qevent_handle() falls through the switch statement and incorrectly returns the skb to the caller with the assumption that classification passed successfully.
This improper handling creates a dangerous state where the RED qdisc continues to operate on an skb that it no longer owns, leading to undefined behavior when attempting operations such as enqueueing packets, dropping them, or updating statistics. The vulnerability specifically manifests when using tc commands to configure RED qdisc with early_drop queueing events combined with conntrack actions that enable defragmentation, creating a scenario where fragmented UDP streams generate out-of-order fragments that trigger the problematic code path.
The operational impact of this vulnerability extends beyond simple memory corruption, as it enables potential privilege escalation and system instability through use-after-free conditions that can be exploited by malicious actors. The flaw affects the kernel's traffic control subsystem and represents a failure in proper resource management within the networking stack's packet processing pipeline. This vulnerability directly relates to CWE-416, which describes use-after-free errors, and aligns with ATT&CK techniques involving privilege escalation through kernel exploits. The issue demonstrates poor adherence to kernel memory management principles where resources are not properly tracked through their lifecycle, particularly in multi-threaded or asynchronous packet processing scenarios.
The recommended mitigation involves implementing proper handling of TC_ACT_CONSUMED return codes within tcf_qevent_handle() by treating such cases identically to TC_ACT_STOLEN scenarios, specifically returning NULL without attempting any further skb operations. This approach ensures that packets which have been consumed by classifiers are not subject to further processing by the qdisc engine, preventing the use-after-free condition while maintaining proper resource ownership semantics. The fix essentially standardizes the behavior across different kernel code paths and enforces consistent packet ownership rules throughout the traffic control subsystem's operation.