CVE-2026-22987: Linux Kernel Use-After-Free Vulnerability

CVE-2026-22987 Overview

A vulnerability has been identified in the Linux kernel's network traffic control subsystem (net/sched). The issue occurs in tcf_idrinfo_destroy() within the act_api module, where an ERR_PTR(-EBUSY) value is improperly passed as a tc_action pointer during network namespace (netns) teardown. This leads to an invalid pointer dereference when tc_act_in_hw() attempts to access the error pointer as a valid action structure.

The vulnerability was discovered through syzbot automated testing, which identified the crash condition during netns teardown operations. The root cause stems from insufficient validation of IDR (ID Radix tree) entries before dereferencing them as action pointers.

Critical Impact

Local denial of service through kernel crash during network namespace teardown operations. Systems using traffic control actions with hardware offload capabilities are potentially affected.

Affected Products

• Linux kernel (specific version ranges pending vendor confirmation)
• Systems utilizing net/sched traffic control with act_api module
• Network configurations employing hardware-offloaded TC actions

Discovery Timeline

• 2026-01-23 - CVE-2026-22987 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-22987

Vulnerability Analysis

The vulnerability exists in the traffic control action API (act_api) within the Linux kernel's network scheduler subsystem. During network namespace destruction, the tcf_idrinfo_destroy() function iterates through the action IDR to clean up allocated resources. However, the function fails to properly validate whether entries in the IDR are valid tc_action pointers or error pointers before passing them to tc_act_in_hw().

When an action entry contains an ERR_PTR(-EBUSY) value—which can occur during concurrent operations or error conditions—the subsequent call to tc_act_in_hw() attempts to dereference this error pointer as if it were a valid tc_action structure. This results in accessing invalid memory addresses, causing a kernel crash.

The vulnerability is classified as a Null Pointer Dereference/Invalid Pointer Dereference issue that can lead to denial of service conditions on affected systems.

Root Cause

The root cause is inadequate error pointer validation in the tcf_idrinfo_destroy() cleanup path. The IDR (ID Radix tree) used to track traffic control actions can contain error pointers under certain race conditions or error scenarios. The cleanup code assumes all IDR entries are valid action pointers without checking for IS_ERR() conditions before dereferencing.

The fix involves adding a guard to check for ERR_PTR entries when iterating the action IDR, ensuring that tc_act_in_hw() is not called on error pointers during teardown operations.

Attack Vector

The vulnerability can be triggered during network namespace teardown operations. An attacker with local access could potentially trigger this condition by:

1. Creating network namespaces with traffic control configurations
2. Inducing error conditions during action allocation (e.g., resource exhaustion)
3. Triggering namespace destruction while error pointers remain in the action IDR

This results in a kernel crash, causing denial of service. The attack requires local access to create and destroy network namespaces, typically requiring CAP_NET_ADMIN capabilities or root privileges.

The vulnerability manifests in the tcf_idrinfo_destroy() function where iteration over the action IDR fails to validate entries before dereferencing. The fix adds IS_ERR() checks to skip error pointer entries during cleanup. See the kernel commit for technical details.

Detection Methods for CVE-2026-22987

Indicators of Compromise

• Kernel panic or crash logs referencing tc_act_in_hw() or tcf_idrinfo_destroy()
• System crashes during network namespace destruction operations
• Kernel oops messages with call traces through net/sched/act_api.c
• Unexpected system reboots correlating with network configuration changes

Detection Strategies

• Monitor kernel logs for panic messages containing act_api or tc_act_in_hw function references
• Implement kernel crash dump analysis to identify dereference patterns matching this vulnerability
• Deploy SentinelOne Singularity Platform for real-time kernel-level threat detection
• Use system stability monitoring to detect abnormal crash patterns during netns operations

Monitoring Recommendations

• Enable kernel crash dump collection (kdump) for post-incident analysis
• Configure system logging to capture kernel warning and error messages
• Monitor for unusual patterns in network namespace creation/destruction activity
• Implement resource usage alerting to detect potential exploitation attempts through resource exhaustion

How to Mitigate CVE-2026-22987

Immediate Actions Required

• Apply the latest kernel security updates from your distribution vendor
• Review systems for evidence of exploitation through kernel log analysis
• Consider limiting network namespace capabilities for non-privileged users if patches cannot be immediately applied
• Monitor affected systems closely for stability issues until patched

Patch Information

The vulnerability has been addressed through kernel commits that add proper ERR_PTR validation in the tcf_idrinfo_destroy() cleanup path. The patches are available through the stable kernel tree:

• Kernel Commit 67550a1130b647bb0d093c9c0a810c69aa6a30a8
• Kernel Commit adb25a46dc0a43173f5ea5f5f58fc8ba28970c7c

System administrators should update to kernel versions containing these fixes through their distribution's package management system.

Workarounds

• Restrict access to network namespace operations by limiting CAP_NET_ADMIN capabilities
• Avoid using traffic control hardware offload features on vulnerable systems until patched
• Implement strict user access controls to prevent unauthorized network namespace manipulation
• Consider containerization with limited network capabilities for untrusted workloads

# Verify current kernel version
uname -r

# Check for available kernel updates (Debian/Ubuntu)
apt update && apt list --upgradable | grep linux-image

# Check for available kernel updates (RHEL/CentOS)
yum check-update kernel

# Restrict network namespace creation for unprivileged users
sysctl -w user.max_user_namespaces=0