CVE-2026-68138

CVE-2026-68138 — Linux kernel net/sched qdisc rate-table UAF tracking site Source for the CVE-2026-68138 patch-status tracker: a single-page site recording which distributions have shipped a fix for the net/sched qdisc rate-table use-after-free / double-free in the Linux kernel. Where the facts...

CVE-2026-68138

CVE-2026-68138: Linux qdisc rate-table の競合を利用したローカル root 権限取得 このリポジトリには、Linux トラフィックコントロールの rate-table コードにおける競合である CVE-2026-68138 に対する概念実証（PoC）ローカル権限昇格エクスプロイトが含まれています。テストした QEMU 環境では、PoC は外部 UID 1000 の通常プロセスから、初期ユーザー名前空間の UID 0 のシェルへ権限を昇格させます。 警告 このコードは意図的にカーネルヒープの状態を破壊します。所有する隔離済みで使い捨て可能な VM...

Exploit for CVE-2026-68138

CVE-2026-68138: Linux qdisc rate-table race to local root !C...

CVE-2026-68138

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

CVE-2026-68138 net/sched: serialize qdisc_rtab_list against concurrent get/put

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

PT-2026-69538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the network scheduler when handling rate-table lookups, inserts, and frees. The functions qdisc get rtab and qdisc put rtab modify the process-global singly...