CVE-2026-23270

Vulnerability

Overview

CVE-2026-23270 is a use-after-free (UaF) vulnerability in the Linux kernel's net/sched act_ct module. The root cause is that the act_ct action was never designed for the egress path, but some users attached it to egress qdiscs. When a packet is classified as TC_ACT_CONSUMED, the skb is held by the defragmentation engine; if the same packet is later touched by the defrag engine, a UaF occurs [1].

Exploitation

An attacker can trigger this bug by crafting packets that cause the classify function to return TC_ACT_CONSUMED while the skb is still referenced by the defragmentation engine. The attack requires the ability to send packets through a TC filter that uses act_ct on an egress qdisc (other than clsact). No special privileges beyond network access are needed, making it exploitable from unprivileged containers or user namespaces.

Impact

Successful exploitation leads to a use-after-free condition, which can result in memory corruption, denial of service, or potentially arbitrary code execution in kernel context. The CVSS v3 score is 7.8 (High), reflecting the high impact on confidentiality, integrity, and availability.

Mitigation

The fix, merged into the Linux kernel stable branches, restricts act_ct to only bind to clsact/ingress qdiscs and shared blocks [2][3][4]. This prevents the vulnerable code path from being reached on egress. Users should apply the latest kernel updates from their distribution. No workaround is available other than avoiding egress attachment of act_ct.