CVE-2026-64530

What it actually does

This is a Linux kernel use-after-free in the traffic control scheduler path. When traffic classification returns TC_ACT_CONSUMED, the packet buffer has been taken over by another subsystem, such as connection-tracking defragmentation, and the caller no longer owns it. The RED qdisc qevent handling path failed to treat that return value as consumed and continued to enqueue, drop, or update accounting on the same skb. In vulnerable configurations using RED qevents with traffic-control actions such as act_ct, specially ordered fragmented traffic can cause the kernel to access freed or transferred packet memory. The practical result is kernel memory corruption, which can lead to denial of service through a kernel crash and, depending on allocator state and exploitation reliability, potential privilege escalation or arbitrary kernel code execution.

Why it matters to the business

Successful exploitation can crash affected Linux systems or network appliances that rely on vulnerable traffic-control configurations, disrupting packet forwarding, application availability, or host networking. Because the issue is in kernel networking code and has a high CVSS rating, organizations should treat exposed systems as high priority even though public exploit maturity is currently reported as none, EPSS is low, and it is not currently listed in CISA KEV. The highest-risk systems are Linux routers, gateways, firewalls, load balancers, Kubernetes or container hosts, and high-throughput servers using advanced Linux tc/qdisc policy, especially RED qevents combined with connection-tracking actions.

How an attack unfolds

An attacker first needs a target whose Linux kernel is vulnerable and whose traffic-control configuration routes RED qdisc qevents to a classifier block containing an action such as act_ct that can consume an skb during defragmentation. The attacker then sends fragmented network traffic, for example out-of-order UDP fragments, designed to enter the affected qdisc path and trigger connection-tracking defragmentation. During classification, the skb may be consumed and ownership transferred away from the RED enqueue path. Because the vulnerable kernel does not correctly handle TC_ACT_CONSUMED in tcf_qevent_handle(), RED continues operating on a packet buffer it no longer owns. That stale access creates a use-after-free condition in kernel memory. A simple attack may cause a kernel oops or panic and take the system or network path offline; a more advanced exploit would attempt to shape heap state and packet timing to turn the memory corruption into controlled kernel execution.

How to fix it

Apply the vendor-provided Linux kernel update that includes the fix for net/sched cls_api handling of TC_ACT_CONSUMED in tcf_qevent_handle(). No exact fixed package versions were provided in the input, so track the relevant distribution advisories and upgrade to the first kernel build that contains this patch or a later supported kernel. Where immediate patching is not possible, reduce exposure by removing RED qevent configurations, avoiding qevent blocks that invoke act_ct, disabling or changing traffic-control policies that combine RED qdisc qevents with connection-tracking defragmentation, and limiting CAP_NET_ADMIN access so untrusted users or containers cannot install risky tc configurations. For internet-facing routers, gateways, and hosts processing untrusted fragmented traffic, prioritize kernel upgrades over configuration-only mitigations.

How to confirm the fix worked

Confirm the running kernel is a vendor-fixed build, not only that the package is installed; verify with uname, package-manager status, and reboot state. Review vendor changelogs or kernel source to ensure tcf_qevent_handle() explicitly treats TC_ACT_CONSUMED as consumed/stolen and returns without touching or freeing the skb. Check for exposure by reviewing traffic-control state with tc qdisc show, tc -s qdisc show, tc filter show, and tc -s filter show, looking for RED qdiscs using qevent mark or early_drop blocks and filters/actions using act_ct. After remediation, repeat the tc configuration review and, in a controlled test environment only, validate that fragmented out-of-order traffic through RED qevents no longer produces kernel oops, KASAN, use-after-free, or packet-processing instability.

Typical attack path

1. Identify or infer a Linux target that performs traffic shaping with RED qdisc qevents and traffic-control classifier blocks using connection-tracking actions.
2. Send fragmented traffic, commonly UDP fragments, in an order that causes defragmentation behavior in the act_ct path.
3. Trigger a RED qevent such as early_drop or mark so the packet enters tcf_qevent_handle().
4. Cause classification to return TC_ACT_CONSUMED while the skb is no longer owned by the RED enqueue path.
5. Exploit the vulnerable fall-through behavior where RED continues to enqueue, drop, or account for the consumed skb.
6. Cause kernel memory corruption, typically resulting in a crash, packet-processing failure, or potentially controlled kernel-level code execution.

How to detect it

Retrospective exploitation detection is difficult because exploitation occurs inside kernel packet-processing memory and may leave only crash, oops, or instability artifacts. Review kernel logs, persistent journal entries, crash dumps, kdump/vmcore data, hypervisor reset events, and network device availability monitoring for unexplained crashes or packet-processing failures. Focus on stack traces or warnings involving RED qdisc, tcf_qevent_handle, tcf_classify, act_ct, nf_conntrack defragmentation, skb ownership, or use-after-free messages. Correlate these events with bursts of fragmented or out-of-order UDP/IP traffic and with systems that have tc RED qevents configured to blocks containing action ct. Also review administrative audit logs for recent tc qdisc or tc filter changes adding RED qevents or act_ct actions, especially unexpected changes made shortly before a kernel crash. Absence of logs does not rule out exploitation, particularly if the system panicked before logs were flushed.

• kernel: BUG: KASAN: use-after-free
• kernel: BUG: KASAN: slab-use-after-free
• kernel: use-after-free
• kernel: general protection fault
• kernel: kernel BUG at net/sched
• kernel: Oops:
• kernel panic
• tcf_qevent_handle
• tcf_classify
• red_enqueue
• act_ct
• nf_ct_frag6
• nf_defrag_ipv4
• nf_defrag_ipv6
• TC_ACT_CONSUMED
• qdisc red
• qevent early_drop block
• qevent mark block
• action ct
• RED_PROB_MARK
• HARD_MARK
• congestion_drop
• tc qdisc add dev
• tc filter add block

What your security team should do

• Prioritize patching Linux systems that act as routers, gateways, firewalls, load balancers, container hosts, or high-volume network endpoints using Linux traffic control.
• Inventory tc configurations for RED qdisc qevents combined with act_ct or connection-tracking actions, and treat matching systems as exposed until patched.
• If patching is delayed, remove or redesign RED qevent policies that invoke connection-tracking actions, especially early_drop and mark qevents.
• Restrict CAP_NET_ADMIN and equivalent container privileges so workloads cannot create vulnerable qdisc/filter configurations.
• Monitor kernel logs for use-after-free, KASAN, general protection fault, panic, or oops events with stack traces involving RED qdisc, tcf_qevent_handle, act_ct, or skb handling.
• Track Linux distribution advisories for fixed kernel versions because exact fixed package versions were not supplied.
• Do not rely on the low EPSS or absence from KEV as a reason to defer remediation on systems with matching traffic-control exposure.