RHEL 9 : kernel (RHSA-2026:49032)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49032 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: clsapi: Handle TCACTCONSUME...

net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

...

CVE-2026-43035

The CVE affects the Linux kernel net: sched: cls_api code path tc_chain_fill_node, where tcm_info in struct tcmsg was not initialized, leaking heap memory to userspace via a 4-byte field. The fix zeros tcm_info alongside other initialized fields. Affected/patched details from connected docs: upst...

CVE-2026-43035

In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak When building netlink messages, tcchainfillnode never initializes the tcminfo field of struct tcmsg. Since the allocation is not zeroed...

The vulnerability of the tcf_blockbind() function in the net/sched/cls_api.c module of the net/sched subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcfblockbind function in the net/sched/clsapi.c module of the net/sched subsystem of the Linux operating system is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

EUVD-2023-60448

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: remove blockcb from driverlist before freeing Error handler of tcfblockbind frees the whole bo-cblist on error. However, by that time the flowblockcb instances are already in the driver list because driver...

CVE-2023-54193 net/sched: cls_api: remove block_cb from driver_list before freeing

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: remove blockcb from driverlist before freeing Error handler of tcfblockbind frees the whole bo-cblist on error. However, by that time the flowblockcb instances are already in the driver list because driver...

CVE-2023-54193

CVE-2023-54193 affects the Linux kernel net/sched cls_api flow: when tcf_block_bind() errors, flow_block_cb objects were still in the driver_list, causing use-after-free. The fix removes flow_block_cb entries from driver_list before deallocation (the patch references show the changes). Affected: ...

CVE-2023-54193

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: remove blockcb from driverlist before freeing Error handler of tcfblockbind frees the whole bo-cblist on error. However, by that time the flowblockcb instances are already in the driver list because driver...

The vulnerability of the tcf_block_get_ext() function in the net/sched/cls_api.c module of the network/sched subsystem of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the tcfblockgetext function in the net/sched/clsapi.c module of the net/sched subsystem of the Linux operating system is related to operations involving resources after their expiration. Exploiting this vulnerability could allow an attacker to cause a service failure...

kernel: net/sched: cls_api: fix error handling causing NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix error handling causing NULL dereference tcfextsmisscookiebasealloc calls xaalloccyclic which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Fixed error handling that caused NULL dereference. The function tcfextsmisscookiebasealloc calls xaalloccyclic, which may return 1 if the allocation succeeds after wrapping. This was previously treated as an...

AZL-58511 CVE-2025-21857 affecting package kernel for versions less than 6.6.82.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix error handling causing NULL dereference tcfextsmisscookiebasealloc calls xaalloccyclic which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to...

CVE-2025-21857 net/sched: cls_api: fix error handling causing NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix error handling causing NULL dereference tcfextsmisscookiebasealloc calls xaalloccyclic which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to...

kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c

A use-after-free vulnerability was found in the tcnewtfilter function in net/sched/clsapi.c in the Linux kernel. The availability of local, unprivileged user namespaces allows privilege escalation...