CVE-2026-23245: Linux Kernel Race Condition Vulnerability

CVE-2026-23245 Overview

A race condition vulnerability has been identified in the Linux kernel's traffic control (tc) subsystem, specifically within the act_gate action module. The vulnerability occurs when the gate action is replaced while the hrtimer callback or dump path is actively walking the schedule list, potentially leading to use-after-free conditions or inconsistent state access.

The fix converts parameters to an RCU-protected snapshot and swaps updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits the entry list, the existing schedule is preserved so the effective state remains unchanged.

Critical Impact
This race condition in the kernel's network scheduler could allow local attackers to cause system instability, denial of service, or potentially achieve privilege escalation through memory corruption.

Affected Products

Linux kernel with act_gate module enabled (CONFIG_NET_ACT_GATE)
Systems using Traffic Control (tc) with gate actions for Time-Sensitive Networking (TSN)
Enterprise Linux distributions with affected kernel versions

Discovery Timeline

2026-03-18 - CVE CVE-2026-23245 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23245

Vulnerability Analysis

The vulnerability exists in the net/sched/act_gate.c component of the Linux kernel, which implements the gate action for traffic control. This action is used in Time-Sensitive Networking (TSN) scenarios to control traffic flow based on time schedules.

The core issue is a race condition that occurs during replacement operations of gate action parameters. When an administrator issues a replace command for a gate action, the hrtimer callback (which handles time-based scheduling) or the dump path (which exposes configuration to userspace) may be concurrently accessing the schedule list. This concurrent access without proper synchronization can lead to accessing freed memory or inconsistent data structures.

The vulnerability is particularly concerning in TSN deployments where gate actions are frequently configured and modified to manage time-critical network traffic. Systems actively using the tc-gate functionality for industrial automation, audio/video bridging, or other time-sensitive applications are at higher risk.

Root Cause

The root cause is improper synchronization when updating gate action parameters during replacement operations. The original implementation did not adequately protect the schedule list with RCU (Read-Copy-Update) semantics, allowing concurrent readers to access parameters that may be freed or modified by the replacement operation. The tcf_lock alone was insufficient to protect against races with the hrtimer callback, which operates in a different execution context.

Attack Vector

An attacker with local access and appropriate permissions to configure traffic control rules (typically requiring CAP_NET_ADMIN capability) could exploit this vulnerability. The attack involves timing manipulation of gate action replacement commands while the system is actively processing timer callbacks or dump requests.

The exploitation scenario involves rapidly issuing tc commands to replace gate actions while monitoring for race conditions. Successful exploitation could result in memory corruption leading to denial of service or potentially kernel code execution.

Detection Methods for CVE-2026-23245

Indicators of Compromise

Unexpected kernel panics or oops messages referencing act_gate, tcf_gate_run, or related functions
System instability occurring during traffic control configuration changes
Memory corruption warnings in kernel logs related to the network scheduler subsystem
Unusual crashes when using tc commands with gate actions

Detection Strategies

Monitor kernel logs for oops or panic messages containing net/sched/act_gate in the call trace
Implement audit logging for tc commands involving gate actions using auditd
Deploy kernel debugging tools like KASAN (Kernel Address Sanitizer) to detect memory access violations
Review system crash dumps for evidence of use-after-free in traffic control code paths

Monitoring Recommendations

Enable kernel crash dump collection (kdump) to capture evidence of exploitation attempts
Monitor for repeated tc configuration changes that could indicate exploitation attempts
Set up alerts for kernel warnings or errors related to network scheduler components
Track system stability metrics on systems using TSN or gate action features

How to Mitigate CVE-2026-23245

Immediate Actions Required

Apply the kernel patches from the stable kernel tree immediately on affected systems
If patching is not immediately possible, consider disabling the act_gate module if not required
Restrict access to traffic control configuration to trusted administrators only
Monitor systems for signs of exploitation while awaiting patch deployment

Patch Information

The Linux kernel development team has released patches addressing this vulnerability. The fix implements RCU-protected snapshots for gate action parameters, ensuring safe concurrent access during replacement operations. Patches are available through the following kernel Git commits:

Organizations should update to kernel versions containing these commits or apply backported patches from their distribution vendor.

Workarounds

Unload the act_gate kernel module if gate actions are not required: modprobe -r act_gate
Restrict CAP_NET_ADMIN capability to essential users and processes only
Avoid frequent replacement of gate action configurations on production systems until patched
Consider using network namespaces to isolate traffic control operations

bash

# Configuration example
# Check if act_gate module is loaded
lsmod | grep act_gate

# Unload the act_gate module if not needed (temporary workaround)
sudo modprobe -r act_gate

# Prevent automatic loading of act_gate module
echo "blacklist act_gate" | sudo tee /etc/modprobe.d/act_gate-blacklist.conf

# Verify current tc gate configurations
tc actions ls action gate