CVE-2026-23245

Vulnerability

CVE-2026-23245 is a use-after-free vulnerability in the Linux kernel's net/sched act_gate (gate action) module. The gate action can be replaced while the hrtimer callback or dump path is concurrently walking the schedule list, leading to a race condition where freed memory may be accessed [1].

Exploitation

An attacker with local access and the ability to replace a gate action (e.g., via netlink operations) can trigger the race. No special privileges beyond those needed to configure traffic control are required, making this a local privilege escalation vector [2].

Impact

Successful exploitation allows an attacker to corrupt kernel memory, potentially leading to arbitrary code execution with kernel privileges. The CVSS v3 score of 7.8 reflects the high impact on confidentiality, integrity, and availability [3].

Mitigation

The fix converts the gate action parameters to an RCU-protected snapshot, swapping updates under tcf_lock and freeing the old snapshot via call_rcu(). When a REPLACE operation omits the entry list, the existing schedule is preserved to maintain effective state. The patch has been applied to the stable kernel tree [4].