Cloudanix VulnDB

CVE-2026-99167

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's network traffic handling can let one part of the system touch memory that another part has already freed, which may crash the machine or let attackers gain more control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in __tcf_action_put() caused by decrementing reference count before binding count, allowing concurrent free of the action and subsequent write to freed memory during binding-count update under the IDR.

Why it matters to the business

Kernel crashes or potential privilege escalation on systems handling network traffic control actions, disrupting network services and requiring urgent patching across Linux deployments.

How an attack unfolds

An attacker with local access issues concurrent tc commands that manipulate actions, racing the reference and binding decrements so that one thread frees the object while another writes to it, triggering the use-after-free.

How to fix it

Apply the upstream fix that holds the action IDR mutex across both counter updates and IDR removal; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the kernel source contains the mutex-protected update sequence around __tcf_action_put(); run KASAN-enabled tests exercising concurrent tc action put operations and verify absence of slab-use-after-free reports.

Typical attack path

  1. Obtain local access on a Linux system
  2. Load or trigger net/sched traffic control actions via tc or equivalent
  3. Race __tcf_action_put() reference and binding count updates from multiple threads
  4. Trigger KASAN-detected write to freed slab memory

How to detect it

Search kernel logs and KASAN reports for the exact BUG string 'KASAN: slab-use-after-free in __tcf_action_put' and the task name 'tc-put-pause'; inspect crash dumps for writes to addresses in the ff11000000d46420 range during action cleanup.

  • KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340
  • Write of size 4 at addr ff11000000d46420 by task tc-put-pause

What your security team should do

  • Patch Linux kernels to the fixed version containing the IDR mutex change as soon as available
  • Monitor for KASAN or slab-use-after-free crashes involving __tcf_action_put
  • Restrict unprivileged local access to tc and netfilter tools until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.

Affected packages

Ecosystem Package Introduced Fixed