CVE-2026-64530: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64530 Overview

CVE-2026-64530 is a use-after-free (UAF) vulnerability in the Linux kernel's traffic control (TC) subsystem, specifically within net/sched/cls_api.c. The flaw resides in tcf_qevent_handle(), which fails to handle the TC_ACT_CONSUMED return code from tcf_classify(). When the defragmentation engine (such as act_ct processing out-of-order fragments) consumes an skb, the caller no longer owns the buffer. However, tcf_qevent_handle() falls through its switch statement and returns the freed skb to the caller. The RED qdisc then enqueues, drops, or updates statistics on memory it does not own, resulting in a UAF condition.

Critical Impact
A remote attacker can trigger a kernel use-after-free by sending fragmented UDP traffic to a system configured with RED qdisc qevents and act_ct defragmentation, potentially enabling arbitrary code execution in kernel context.

Affected Products

Linux Kernel — versions containing the vulnerable tcf_qevent_handle() implementation in net/sched/cls_api.c
Distributions shipping affected upstream kernels with RED qdisc and act_ct support enabled
Systems using TC (traffic control) with RED qdisc qevents (early_drop, mark) chained to act_ct filters

Discovery Timeline

2026-07-26 - CVE-2026-64530 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64530

Vulnerability Analysis

The vulnerability exists in the Linux kernel's classifier API path used by queueing disciplines (qdiscs). The tcf_classify() function can return several action codes including TC_ACT_OK, TC_ACT_STOLEN, and TC_ACT_CONSUMED. The TC_ACT_CONSUMED code signals that a subsystem (such as act_ct connection tracking during IP defragmentation) has taken exclusive ownership of the skb.

The function tcf_qevent_handle() did not include a case for TC_ACT_CONSUMED. Its switch statement fell through to the default path, returning the skb pointer to the caller as if classification had succeeded. The RED qdisc invokes qevents from three call sites: qe_mark on RED_PROB_MARK and RED_HARD_MARK, plus qe_early_drop on congestion_drop. In each case, red_enqueue() continued to operate on the consumed skb, dereferencing freed memory.

Root Cause

The root cause is incomplete return-code handling in tcf_qevent_handle(). The ingress and egress fast paths correctly treat TC_ACT_CONSUMED as "stolen, do not touch," but the qevent handler did not. This creates an ownership violation: the kernel assumes the skb is still valid when the defragmentation engine has already queued it for later reassembly.

Attack Vector

Exploitation requires a target configured with a RED qdisc that uses qevents chained to a filter block containing an act_ct action with defragmentation enabled. An attacker sends fragmented UDP traffic that arrives out of order, causing act_ct to hold fragments for reassembly and return TC_ACT_CONSUMED. The subsequent operation on the freed skb inside red_enqueue() triggers the UAF. The condition is reachable over the network without authentication when a vulnerable configuration is present.

The upstream fix modifies tcf_qevent_handle() to detect TC_ACT_CONSUMED and return NULL without dropping or freeing the skb, mirroring the fast-path behavior. See the fix commits including Linux Kernel Commit 5ed3d6f8 and Linux Kernel Commit f42e8134.

Detection Methods for CVE-2026-64530

Indicators of Compromise

Kernel oops or panic messages referencing red_enqueue, tcf_qevent_handle, or tcf_classify in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free in net/sched/cls_api.c or net/sched/sch_red.c
Unexpected network interface hangs or qdisc statistics anomalies on systems using RED with act_ct
Sudden bursts of fragmented UDP traffic targeting hosts running affected qdisc configurations

Detection Strategies

Inventory hosts running vulnerable kernel versions and enumerate active qdisc configurations using tc qdisc show and tc filter show
Flag systems that combine RED qdisc with qevent early_drop or qevent mark chained to filter blocks containing action ct
Enable KASAN in test or canary environments to surface latent UAF triggers during fragmented traffic replay
Correlate kernel crash telemetry with fragmented UDP flow patterns using centralized log analytics

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized data lake for longitudinal analysis and correlation
Alert on repeated kernel oops events referencing traffic control symbols across the fleet
Monitor for anomalous rates of IP fragmentation targeting hosts that operate as network gateways or firewalls
Track kernel package versions across Linux endpoints to identify unpatched systems in real time

How to Mitigate CVE-2026-64530

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and reboot affected hosts as soon as vendor builds are available
Audit all Linux systems for RED qdisc configurations that reference qevents and disable them where operationally feasible until patching completes
Restrict fragmented UDP ingress at upstream network devices to reduce exposure to the trigger condition
Prioritize patching for network-facing hosts, routers, and firewalls where act_ct and RED qdisc combinations are commonly deployed

Patch Information

The upstream fix modifies tcf_qevent_handle() to handle TC_ACT_CONSUMED identically to how ingress and egress paths do — treating the skb as stolen and returning NULL without freeing it. Relevant stable-tree commits include Linux Kernel Commit 2140c2f, Linux Kernel Commit 447d4930, Linux Kernel Commit 5ed3d6f8, Linux Kernel Commit a8a02897, Linux Kernel Commit e1270e69, Linux Kernel Commit e28aedab, and Linux Kernel Commit f42e8134. Consume the fix through your distribution's kernel update channel.

Workarounds

Remove qevent clauses from RED qdisc configurations (tc qdisc change ... red ... qevent ...) until kernel patches are deployed
Disable act_ct connection tracking actions on filter blocks referenced by RED qevents
Drop IP fragments at network perimeters using firewall rules where application traffic tolerates it
Move traffic shaping to alternative qdiscs that do not use the qevent mechanism if latency and fairness requirements allow

bash

# Remove qevent-based RED configuration as a temporary workaround
# Replace eth0 and block/handle IDs with values from your environment
tc qdisc del dev eth0 root handle 1: red

# Verify no filter blocks reference act_ct where qevents were previously wired
tc filter show block 10