Cloudanix VulnDB

CVE-2026-68377

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain network traffic rules can let a local user crash the system or potentially run code with higher privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition use-after-free in tunnel_key_release_params() where dst_release() is called synchronously on old metadata_dst while params are freed via kfree_rcu, allowing a concurrent RCU-protected reader in tunnel_key_act() to invoke dst_clone after the dst rcuref is marked dead.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes, memory corruption, or potential privilege escalation when traffic control tunnel_key actions are configured or offloaded, risking system stability and security on servers or appliances using advanced networking features.

How an attack unfolds

An attacker with local access crafts a sequence of tc action operations that allocate and release tunnel_key params while a datapath reader holds a reference under rcu_read_lock_bh; the race leads to dst_release decrementing a dead rcuref, detected via KASAN in slab-use-after-free during dst_release.

How to fix it

Upgrade the Linux kernel to a version containing the commit that defers dst_release to an RCU callback in act_tunnel_key; rebuild and reboot with the patched kernel; avoid use of tunnel_key actions until updated if possible.

How to confirm the fix worked

Verify the running kernel contains the fix by checking the source for deferred dst_release in tunnel_key_release_params or confirming the commit message; recompile with KASAN and attempt reproduction of the original PoC to ensure no slab-use-after-free is reported.

Typical attack path

  1. Obtain local unprivileged or low-privileged access on a Linux host
  2. Use tc or equivalent to install or offload a tunnel_key action via tcf_action_init and offload paths
  3. Trigger concurrent release of params in tunnel_key_release_params while datapath executes tunnel_key_act
  4. Cause dst_clone on the freed dst object leading to use-after-free and KASAN report or kernel panic

How to detect it

Search kernel logs and dmesg for KASAN reports mentioning slab-use-after-free in dst_release, rcuref_put, or act_tunnel_key; inspect crash dumps for skb_release_head_state and tunnel_key paths; review audit logs for tc action additions around the time of instability.

  • KASAN: slab-use-after-free in dst_release
  • BUG: KASAN: slab-use-after-free in __rcuref_put
  • dst_release+0x5b/0x370 net/core/dst.c
  • tunnel_key_release_params
  • tcf_action_offload_add_ex

What your security team should do

  • Prioritize kernel updates on all systems using tc actions or network offload features
  • Monitor for kernel panics or KASAN reports involving dst_release and act_tunnel_key
  • Restrict local user access to tc and netlink interfaces where feasible until patched
  • Test patched kernels in staging before broad deployment due to networking impact

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_tunnel_key: Defer dst_release to RCU callback Fix a race-condition use-after-free in tunnel_key_release_params(). The function releases the metadata_dst of the old params synchronously via dst_release() while deferring the params struct free with kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may still hold the old params pointer (under rcu_read_lock_bh) and proceed to call dst_clone(&params->tcft_enc_metadata->dst) after the writer's dst_release has already pushed the dst's rcuref to RCUREF_DEAD. zdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified that KASAN reports: ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388 CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 print_report+0x139/0x4ad mm/kasan/report.c:482 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 kasan_check_range+0x125/0x200 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 __rcuref_put include/linux/rcuref.h:109 rcuref_put include/linux/rcuref.h:173 dst_release+0x5b/0x370 net/core/dst.c:168 refdst_drop include/net/dst.h:272 skb_dst_drop include/net/dst.h:284 skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163 skb_release_all net/core/skbuff.c:1187 [..] Allocated by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 __do_kmalloc_node mm/slub.c:5296 __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 kzalloc_noprof include/linux/slab.h:1188 offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35 tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 [..] Freed by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 slab_free_hook mm/slub.c:2689 slab_free mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 64 bytes inside of freed 256-byte region [ffff88806158de00, ffff88806158df00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Affected packages

Ecosystem Package Introduced Fixed