CVE-2026-68138: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68138 Overview

CVE-2026-68138 is a race condition in the Linux kernel's net/sched subsystem that leads to a use-after-free and double-free of the struct qdisc_rate_table. The functions qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global qdisc_rtab_list singly linked list and a non-atomic refcnt field without holding a lock. Historically the RTNL mutex serialized these operations, but cls_flower now runs with TCF_PROTO_OPS_DOIT_UNLOCKED, causing tcf_police_init() to invoke these helpers without RTNL held. Concurrent RTM_NEWTFILTER requests on different CPUs corrupt the shared list.

Critical Impact
Local attackers with CAP_NET_ADMIN in any network namespace can trigger a system-wide use-after-free on a kmalloc-2k slab object, enabling kernel memory corruption and potential privilege escalation.

Affected Products

Linux Kernel net/sched subsystem (mainline)
Distributions shipping kernels with cls_flower using TCF_PROTO_OPS_DOIT_UNLOCKED
Systems using tc filters with police actions

Discovery Timeline

2026-08-10 - CVE-2026-68138 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68138

Vulnerability Analysis

The Linux traffic control subsystem maintains a global singly linked list qdisc_rtab_list that caches rate tables shared across queueing disciplines. Access to this list and the associated int refcnt reference counter was historically serialized by the RTNL mutex held by every caller. The introduction of TCF_PROTO_OPS_DOIT_UNLOCKED on cls_flower broke this invariant. When tc_new_tfilter() processes a flower filter, it sets rtnl_held == false and propagates TCA_ACT_FLAGS_NO_RTNL through tcf_exts_validate_ex(), tcf_action_init(), tcf_action_init_1(), and into tcf_police_init(). That function calls qdisc_get_rtab() and qdisc_put_rtab() without RTNL protection. Two concurrent RTM_NEWTFILTER requests adding flower filters with police actions carrying the same rate parameters race on both the list traversal and the non-atomic refcount decrement, producing a use-after-free or double-free of a 2048-byte struct qdisc_rate_table object.

Root Cause

The root cause is a race condition [CWE-362] combined with a use-after-free [CWE-416] in shared kernel state. qdisc_rtab_list is a single global structure, not per-network-namespace, so the corrupted object is shared system-wide. The non-atomic refcnt increment and decrement operations are not safe against concurrent modification, and the linked list insertion and removal lack any synchronization primitive.

Attack Vector

A local attacker with CAP_NET_ADMIN capability sends two or more concurrent RTM_NEWTFILTER netlink messages from different CPUs. Each message installs a cls_flower classifier with a police action referencing the same rate table parameters. Because cls_flower runs unlocked, the calls to qdisc_get_rtab() and qdisc_put_rtab() race on the global list and refcount. The resulting KASAN report shows slab-use-after-free in qdisc_put_rtab+0x12f/0x160 originating from the tcf_police_init call path. Successful exploitation can lead to kernel memory corruption and privilege escalation to root.

The upstream fix introduces a dedicated spinlock protecting both qdisc_rtab_list and the refcount. The sleeping GFP_KERNEL allocation in qdisc_get_rtab() is performed before acquiring the lock; if a concurrent inserter added an identical table, the freshly allocated one is freed under the lock. See the kernel commits f43ee0c0730d and fb29e1b41052 for the applied patches.

Detection Methods for CVE-2026-68138

Indicators of Compromise

KASAN reports referencing slab-use-after-free in qdisc_put_rtab in kernel logs
Kernel panics or oops traces originating from tcf_police_init on the kmalloc-2k slab cache
Unexpected process crashes or kernel warnings following bursts of tc filter add operations

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the exact use-after-free pattern in qdisc_put_rtab
Audit auditd records for netlink messages of type RTM_NEWTFILTER originating from unprivileged workloads or containers
Correlate rapid, parallel tc invocations against the same network device with subsequent kernel instability

Monitoring Recommendations

Ingest kernel ring buffer logs (/dev/kmsg, journald) into a centralized data lake and alert on KASAN, BUG, and oops signatures
Track processes invoking CAP_NET_ADMIN-gated netlink operations, particularly from containers with elevated network capabilities
Baseline the rate of tc filter changes per host and alert on anomalous spikes indicative of exploitation attempts

How to Mitigate CVE-2026-68138

Immediate Actions Required

Apply the upstream kernel patches from commits f43ee0c0730d and fb29e1b41052 or upgrade to a stable kernel release that includes them
Restrict CAP_NET_ADMIN in containers and unprivileged user namespaces where traffic control configuration is not required
Audit workloads that programmatically manage tc filters with police actions and reduce concurrency until patched

Patch Information

The fix serializes qdisc_rtab_list and the refcnt field with a dedicated spinlock. Allocation in qdisc_get_rtab() occurs before the lock is taken, and duplicates are freed under the lock to prevent leaks. qdisc_put_rtab() now decrements the refcount and unlinks list entries atomically under the same lock. Patch references: kernel commit f43ee0c0730d and kernel commit fb29e1b41052.

Workarounds

Disable or avoid cls_flower filters with police actions on hosts that cannot be patched immediately
Drop CAP_NET_ADMIN from container runtime profiles and seccomp allowlists where traffic shaping is not required
Serialize tc filter management through a single administrative process to eliminate concurrent RTM_NEWTFILTER requests

bash

# Verify running kernel version and confirm patch presence
uname -r

# Drop CAP_NET_ADMIN in containerized workloads (Docker example)
docker run --cap-drop=NET_ADMIN <image>

# Restrict user namespace creation to reduce local attack surface
sysctl -w kernel.unprivileged_userns_clone=0