net/sched: act_api: use RCU with deferred freeing for action lifecycle
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_r
CVE-2026-53264
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53264
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "98b2e40879abf0245be5a5b7af69e0f6ff524ac3",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "18af5d2ef0c4f65787fd1280c8b23286b9f2a835",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "1f1b98fea6b9ea30507d0f2fbff6750292d097e2",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "8b136f18ac4b2ace5aaad3305b3f8a5d8165a009",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "5dd51e09020c65aa53cf128e5e3517cd53b3c113",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "b60e9391142e983fab2be53497aa8f71fdd09cd5",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "91d105d2cbe002f9c7b43a6183adedc37e1da1f7",
"versionType": "git"
},
{
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"lessThan": "5057e1aca011e51ef51498c940ef96f3d3e8a305",
"versionType": "git"
}
],
"programFiles": [
"include/net/act_api.h",
"net/sched/act_api.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/act_api.h",
"net/sched/act_api.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53264
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28445 · Revision 1
- Added to Heist Feed
- Publisher date