CVE-2026-23270: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23270 Overview

A Use-After-Free vulnerability has been identified in the Linux kernel's traffic control (TC) subsystem, specifically within the act_ct (connection tracking) action implementation. The flaw occurs when act_ct is improperly bound to egress qdiscs that do not handle TC_ACT_CONSUMED return values correctly. When the defragmentation engine holds an skb (socket buffer) and the classify function returns TC_ACT_CONSUMED, subsequent attempts by the defrag engine to access the packet can result in a Use-After-Free condition.

Critical Impact

This vulnerability can lead to memory corruption, kernel crashes, or potential privilege escalation through exploitation of the Use-After-Free condition in the kernel's network traffic control subsystem.

Affected Products

• Linux Kernel (versions prior to the security patch)
• Systems using act_ct with egress qdiscs other than clsact/ingress
• Network configurations utilizing TC connection tracking actions

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-23270 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-23270

Vulnerability Analysis

The vulnerability exists in the Linux kernel's net/sched subsystem, specifically in the act_ct (connection tracking) action module. The root issue stems from the handling of TC_ACT_CONSUMED return values when act_ct is attached to egress paths.

When a packet is being processed by the defragmentation engine and the classify function returns TC_ACT_CONSUMED, the current skb is held by the defrag engine. However, most qdiscs are not designed to handle this return value properly, leading to a situation where the packet may be freed while the defragmentation engine still holds a reference to it. This creates a classic Use-After-Free condition when the defrag engine later attempts to access the already-freed packet memory.

The vulnerability was reported by Gangmin Kim, who identified that certain packet processing scenarios could trigger this UaF condition. The act_ct module was originally intended for use in ingress paths only, but users had begun attaching it to egress configurations, exposing this vulnerability.

Root Cause

The root cause lies in the mismatch between act_ct's return behavior and the expectations of various qdisc implementations. When act_ct returns TC_ACT_CONSUMED during packet classification, the expectation is that the skb is being held for deferred processing (such as defragmentation). However, qdiscs not designed to handle this return code may proceed to free or reuse memory associated with the packet.

The clsact/ingress qdiscs properly handle TC_ACT_CONSUMED, while other qdisc types do not have this handling, creating an inconsistent and exploitable condition when act_ct is bound to inappropriate qdisc types.

Attack Vector

The attack vector involves local manipulation of the traffic control subsystem. An attacker with sufficient privileges to configure TC rules could potentially:

1. Attach act_ct to a non-clsact egress qdisc
2. Send specially crafted fragmented packets that trigger the defragmentation engine
3. Cause the classify function to return TC_ACT_CONSUMED
4. Exploit the resulting UaF when the defrag engine accesses freed memory

The vulnerability requires local access to configure TC rules and the ability to inject or influence network traffic. The UaF condition could potentially be leveraged for kernel memory corruption, denial of service, or privilege escalation depending on the specific memory layout at the time of exploitation.

Detection Methods for CVE-2026-23270

Indicators of Compromise

• Unexpected kernel panics or crashes related to net/sched or act_ct modules
• KASAN (Kernel Address Sanitizer) reports indicating Use-After-Free in TC subsystem
• Abnormal TC configurations binding act_ct to non-clsact/ingress qdiscs
• Memory corruption artifacts in network-related kernel structures

Detection Strategies

• Monitor kernel logs for KASAN or SLUB debugging warnings related to act_ct or net/sched
• Audit TC configurations using tc filter show and tc actions show to identify act_ct bindings to egress qdiscs
• Deploy kernel instrumentation to track TC_ACT_CONSUMED returns in non-clsact contexts
• Use eBPF-based monitoring to observe TC action invocations and qdisc interactions

Monitoring Recommendations

• Enable KASAN in development/testing environments to catch UaF conditions
• Implement centralized logging for kernel messages related to network traffic control
• Review and audit network namespace configurations for unexpected TC rule modifications
• Monitor system stability metrics for unexplained kernel-related issues on systems utilizing TC features

How to Mitigate CVE-2026-23270

Immediate Actions Required

• Apply the kernel patches from the official git repositories immediately
• Audit existing TC configurations to identify any act_ct bindings to non-clsact qdiscs
• Temporarily remove or reconfigure act_ct actions that are bound to egress paths outside of clsact
• Restrict access to TC configuration capabilities to trusted administrators only

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix restricts act_ct to only bind to clsact/ingress qdiscs and shared blocks, ensuring that the TC_ACT_CONSUMED return value is always handled correctly.

Security patches are available via the following kernel git commits:

• Kernel Git Commit 11cb63b0
• Kernel Git Commit 380ad8b7
• Kernel Git Commit 524ce8b4
• Kernel Git Commit 9deda0fc

Update your kernel to a version containing these patches or apply the patches to your current kernel build.

Workarounds

• Migrate act_ct configurations to use only clsact qdiscs for both ingress and egress
• Remove act_ct bindings from traditional egress qdiscs until patched kernels are deployed
• Implement network policy restrictions to limit TC configuration changes
• Consider using alternative connection tracking approaches that don't rely on act_ct for egress paths

# Audit existing act_ct configurations
tc actions show action ct

# Remove act_ct from non-clsact egress qdiscs
tc filter del dev eth0 egress handle 1 pref 1

# Reconfigure with clsact (which properly handles TC_ACT_CONSUMED)
tc qdisc add dev eth0 clsact
tc filter add dev eth0 egress protocol ip pref 1 handle 1 flower action ct