kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

RHEL 9 : kernel-rt (RHSA-2026:55443)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55443 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements...

CVE-2026-74544

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits...

CVE-2026-74544

The CVE-2026-74544 issue is in the Linux kernel net/sched cls_u32 implementation. u32_change() copies offshift (unsigned char, 0-255) without bounds checks, enabling undefined behavior (shift-out-of-bounds) in u32_classify() when TC_U32_VAROFFSET is set and offshift ≥ 32. Public sources (Linux ke...

CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

CVE-2026-72430

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix nfconnlabels leak on two error paths tcfctfillparams calls nfconnlabelsget setting putlabels when TCACTLABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err:...

CVE-2026-72390

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit, teqldequeue, teqlinit...

CVE-2026-72326

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

UBUNTU-CVE-2026-72430

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix nfconnlabels leak on two error paths tcfctfillparams calls nfconnlabelsget setting putlabels when TCACTLABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err:...

UBUNTU-CVE-2026-74382

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

CVE-2026-72057

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

CVE-2026-72036

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

UBUNTU-CVE-2026-72035

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

UBUNTU-CVE-2026-72036

In the Linux kernel, the following vulnerability has been resolved: net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call after multiqpeek peeked it. When the child is non-work-conserving the...

EUVD-2026-59437

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: Dont expose folded kernel pointers The flow classifier falls back to addrfold for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can...

CVE-2026-74284 net/sched: sch_hfsc: Don't make class passive twice

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

EUVD-2026-59329

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix nfconnlabels leak on two error paths tcfctfillparams calls nfconnlabelsget setting putlabels when TCACTLABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err:...