net/sched: serialize qdisc_rtab_list against concurrent get/put
In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list an
CVE-2026-68138
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-68138
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "1b050d09dd1a0ddae83bf012cf4956b7a960235f",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "6e0241f6cbb149d926ee8efee2c734fea71452cf",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "f93c89392bd3b180b5b7abc6fdae8e3dd667a313",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "4131dd0b6f67acddd616ed7c244e1d3eedd46e7b",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "d981098b76756ed71666a27518eeb69883657c43",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "8ddc2eb0d2da9c83f54f1e5720525b461b8480c4",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "fb29e1b41052488ee3f2d115d4a870497ebd7f7d",
"versionType": "git"
},
{
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"lessThan": "f43ee0c0730d6191629b5ee1ceae27b1ebfdc047",
"versionType": "git"
}
],
"programFiles": [
"net/sched/sch_api.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sched/sch_api.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-68138
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41130 · Revision 1
- Added to Heist Feed
- Publisher date