CVE-2026-68138 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: serialize qdisc_rtab_list against concurrent get/put
qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees.
That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide.
BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048
Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described represents a critical race condition in the Linux kernel's traffic control subsystem, specifically within the qdisc (queueing discipline) implementation. This flaw affects the global singly linked list qdisc_rtab_list which manages rate tables used by network filters, particularly those implementing policing actions through the cls_flower classifier. The issue stems from the removal of the RTNL mutex serialization that previously protected all rate table operations, a change introduced when the cls_flower classifier began using TCF_PROTO_OPS_DOIT_UNLOCKED flag.
The technical implementation involves two primary functions qdisc_get_rtab() and qdisc_put_rtab() which manipulate both a global process-wide linked list and a non-atomic integer reference counter without proper synchronization. Previously, all callers held the RTNL mutex exclusively, ensuring safe access to this shared data structure. However, with cls_flower's updated behavior, these functions can now be invoked without holding the RTNL lock, creating a scenario where concurrent CPU threads executing RTM_NEWTFILTER requests can simultaneously access and modify the same global rate table structures. This lack of synchronization directly violates fundamental concurrency principles and creates conditions for memory safety violations.
The operational impact of this vulnerability manifests as use-after-free and double-free conditions in kernel memory management. When multiple CPU cores attempt to add flower filters with identical policing parameters, they race to access the shared qdisc_rtab_list and its associated refcnt field. The kmalloc-2k allocated structures become corrupted through concurrent modifications, leading to memory safety violations that can result in system crashes or potential privilege escalation. The KASAN report specifically indicates a slab-use-after-free error occurring in qdisc_put_rtab function during kernel memory deallocation, where the freed object belongs to the kmalloc-2k cache of size 2048, confirming the memory corruption pattern.
The fix implements proper synchronization using a dedicated spinlock to protect access to both the global qdisc_rtab_list and its associated reference count. This approach ensures that all operations on rate table structures occur under exclusive lock protection, preventing concurrent modifications that could lead to data corruption. The implementation handles potential race conditions during allocation by freeing duplicate allocations under lock protection, ensuring no memory leaks occur while maintaining proper reference counting. This solution aligns with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and addresses ATT&CK techniques related to privilege escalation through kernel memory corruption. The spinlock-based approach maintains performance characteristics while providing necessary serialization guarantees for kernel-level concurrency control, ensuring that the global rate table management remains consistent across all concurrent operations within the networking subsystem.