Linux Kernel Net Scheduler Vulnerability Allows Local Privilege Escalation
A Time-Of-Check Time-Of-Use (TOCTOU) vulnerability in the Linux Kernel's Net Scheduler Packet Classifier API allows local attackers to escalate privileges.
A critical vulnerability has been identified within the Linux Kernel's Net Scheduler Packet Classifier API, enabling local privilege escalation. This flaw, designated ZDI-26-575 by the Zero Day Initiative, allows an attacker who has already gained the ability to execute high-privileged code on a target system to further escalate their privileges.
The vulnerability is characterized as a Time-Of-Check Time-Of-Use (TOCTOU) issue. TOCTOU vulnerabilities occur when a system checks the state of an object or resource, and then later uses that object or resource, but the state of the object can change between the check and the use. In this specific case, the Net Scheduler Packet Classifier API is susceptible to this race condition, allowing an attacker to manipulate the system's state to achieve unauthorized privilege gains.
Exploitation of this vulnerability requires prior high-privileged code execution on the affected system. This means that an attacker cannot use this flaw as an initial entry vector. Instead, it serves as a post-exploitation tool for an attacker who has already compromised a system with some level of elevated permissions, allowing them to move to a higher privilege level, such as root.
The Zero Day Initiative has assigned this vulnerability a CVSS score of 7.5, indicating a high severity. While the prerequisite of having existing high-privileged code execution limits its immediate impact as an initial access vector, it remains a significant threat for maintaining or deepening a compromise.
Details regarding specific affected versions of the Linux Kernel or the exact nature of the race condition within the Net Scheduler Packet Classifier API have not been fully disclosed in the initial advisory. However, the nature of the vulnerability suggests that any system running a susceptible version of the Linux kernel could be at risk if an attacker gains a foothold.
As with many kernel-level vulnerabilities, patching and updating systems promptly is the most effective defense. Users and administrators are advised to monitor for security advisories from their Linux distribution vendors and apply any available kernel updates as soon as possible. The disclosure by Zero Day Initiative signals that the vulnerability is known and potentially being analyzed by threat actors.
This discovery underscores the ongoing importance of securing the Linux kernel, a foundational component of countless systems worldwide, from servers to embedded devices. Even vulnerabilities requiring prior access can have a cascading effect, turning a limited compromise into a full system takeover.
This advisory details ZDI-26-574, which specifically affects the Linux Kernel's net scheduler connection tracking and is assigned CVE-2026-46319. The vulnerability is a race condition that requires an attacker to already possess high-privileged code execution to exploit, and it carries a CVSS score of 7.5.
The Zero Day Initiative advisory ZDI-26-568 details a race condition within the Linux Kernel's net scheduler that enables local privilege escalation. This vulnerability requires prior high-privileged code execution on the target system for exploitation, and ZDI has assigned it a CVSS score of 7.5.
This new advisory from Zero Day Initiative details a specific use-after-free vulnerability within the Linux Kernel's net scheduler packet classifier API, assigned CVE-2026-64530. The vulnerability has a high CVSS score of 8.8 and allows local privilege escalation, requiring prior low-privileged code execution for exploitation.