CVE-2026-22987: Linux Kernel Use-After-Free Vulnerability

CVE-2026-22987 Overview

CVE-2026-22987 is a null pointer dereference vulnerability [CWE-476] in the Linux kernel's traffic control action subsystem (net/sched/act_api.c). The flaw resides in tcf_idrinfo_destroy(), which fails to validate ERR_PTR entries when iterating the action IDR during network namespace teardown. A local attacker with low privileges can trigger the condition, causing the kernel to dereference an ERR_PTR(-EBUSY) value as a valid tc_action pointer inside tc_act_in_hw(). The issue was reported by syzbot and affects Linux kernel versions in the 6.19 release candidate series.

Critical Impact
Local users with the ability to manipulate network namespaces and traffic control actions can crash the kernel, resulting in a denial-of-service condition on the affected host.

Affected Products

Linux kernel 6.19-rc1
Linux kernel 6.19-rc2 through 6.19-rc4
Distributions shipping unpatched mainline 6.19 release candidates

Discovery Timeline

2026-01-23 - CVE-2026-22987 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-22987

Vulnerability Analysis

The vulnerability exists in the traffic control (tc) action API within the Linux kernel networking stack. The function tcf_idrinfo_destroy() walks the per-namespace IDR that tracks tc_action instances during network namespace teardown. The IDR can legitimately contain ERR_PTR(-EBUSY) placeholder values used to reserve slots during concurrent action allocation. The destroy path treats these placeholder values as valid pointers and forwards them to tc_act_in_hw(), which dereferences the encoded error value as if it were a real tc_action structure.

The resulting invalid pointer access triggers a kernel oops. Because the path runs during netns cleanup, the crash can occur asynchronously and impact system stability. The vulnerability is classified as [CWE-476] Null Pointer Dereference, though the underlying issue is a missing IS_ERR() check on encoded error pointers.

Root Cause

The root cause is missing validation of IDR entries before use. The Linux kernel uses the ERR_PTR encoding scheme to pack negative error codes into pointer-shaped values. When tcf_idrinfo_destroy() iterates the action IDR, it does not call IS_ERR() to filter out reservation placeholders, leading to direct dereference of an encoded -EBUSY value.

Attack Vector

An attacker requires local access with privileges sufficient to create network namespaces and manipulate traffic control actions, such as CAP_NET_ADMIN within a user namespace. The attacker races tc action creation against namespace teardown to leave an ERR_PTR(-EBUSY) entry in the IDR at the moment tcf_idrinfo_destroy() runs. The exploitation pattern matches the syzbot reproducer that originally surfaced the bug. No user interaction is required, and exploitation yields a denial-of-service outcome consistent with the CVSS impact metrics. The vulnerability mechanism is described in detail in the upstream commits referenced below; no public proof-of-concept beyond the syzbot report is currently available.

Detection Methods for CVE-2026-22987

Indicators of Compromise

Kernel oops or panic messages referencing tc_act_in_hw or tcf_idrinfo_destroy in dmesg or /var/log/kern.log.
Unexpected host reboots or hangs correlated with network namespace teardown operations.
Repeated tc action add/delete operations originating from unprivileged containers or sandboxed workloads.

Detection Strategies

Monitor kernel ring buffer output for crash signatures involving the act_api subsystem and ERR_PTR dereferences.
Audit usage of CAP_NET_ADMIN inside user namespaces, particularly in container runtimes that expose tc configuration to workloads.
Track syscalls related to setsockopt, RTM_NEWACTION, and unshare(CLONE_NEWNET) from non-root users.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on oops traces referencing networking subsystems.
Baseline normal tc activity per host and flag spikes from container workloads.
Correlate namespace creation/teardown events with subsequent kernel instability indicators.

How to Mitigate CVE-2026-22987

Immediate Actions Required

Apply the upstream stable kernel updates referenced in the kernel.org commits as soon as distribution packages are available.
Restrict CAP_NET_ADMIN and user namespace creation for untrusted users where operationally feasible.
Disable or constrain container workloads that require traffic control manipulation until patched kernels are deployed.

Patch Information

The issue is resolved upstream by two commits that guard the IDR iteration against ERR_PTR entries. See Kernel Git Commit adb25a46dc0a and Kernel Git Commit 67550a1130b6. The fix adds an IS_ERR() check inside tcf_idrinfo_destroy() so that placeholder entries are skipped during namespace teardown.

Workarounds

Set kernel.unprivileged_userns_clone=0 via sysctl to prevent unprivileged user namespace creation on systems where this is acceptable.
Remove CAP_NET_ADMIN from container security profiles that do not require traffic shaping.
Use seccomp or LSM policies to block RTM_NEWACTION netlink messages from untrusted workloads.

bash

# Configuration example
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-22987.conf