CVE-2026-68377: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68377 Overview

CVE-2026-68377 is a race-condition use-after-free vulnerability in the Linux kernel's traffic control subsystem, specifically in the net/sched/act_tunnel_key module. The flaw resides in tunnel_key_release_params(), which synchronously releases metadata_dst via dst_release() while deferring the parameter struct free with kfree_rcu(). A concurrent reader in tunnel_key_act() may still hold the old params pointer under rcu_read_lock_bh and call dst_clone() on already-freed memory. Trend Micro's Zero Day Initiative (zdi-disclosures@trendmicro.com) produced a proof-of-concept that triggers KASAN slab-use-after-free reports.

Critical Impact
Local unprivileged attackers with network configuration capabilities can trigger memory corruption in the kernel, enabling privilege escalation or denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the act_tunnel_key traffic control action prior to the fix commits
Distributions shipping affected upstream kernels (RHEL, Ubuntu, Debian, SUSE, and derivatives)
Systems with CONFIG_NET_ACT_TUNNEL_KEY enabled and unprivileged user namespaces available

Discovery Timeline

2026-08-10 - CVE-2026-68377 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68377

Vulnerability Analysis

The vulnerability is a use-after-free triggered by a race between writers and RCU readers in the tunnel_key traffic control action. When parameters are updated, tunnel_key_release_params() invokes dst_release() on the old metadata_dst immediately, then schedules the containing params struct for deferred deallocation using kfree_rcu(). This ordering is unsafe because a concurrent datapath reader holding an RCU read-side critical section may still dereference the params pointer and invoke dst_clone(¶ms->tcft_enc_metadata->dst) after the writer has pushed the dst's rcuref to RCUREF_DEAD. The result is a write to freed memory during atomic reference-count manipulation, reported by KASAN as slab-use-after-free in dst_release+0x5b/0x370.

Root Cause

The root cause is inconsistent lifetime management between the params struct and the dst object it references. The params struct is freed via RCU (kfree_rcu) to synchronize with datapath readers, but the embedded dst is released synchronously via dst_release(). Any reader that observes the old params pointer between the synchronous dst_release and the RCU grace period completion can dereference an already-invalidated dst.

Attack Vector

Exploitation requires local access with permission to configure traffic control actions, typically achieved through CAP_NET_ADMIN in a user namespace. An attacker races repeated updates of a tc action carrying tunnel_key parameters against packet processing on the datapath. Successful races corrupt the slab allocator's freed object state, which can be leveraged for kernel memory disclosure, privilege escalation, or system crash.

No verified public exploit code is available. The reporting proof-of-concept from Trend Micro ZDI demonstrates the KASAN violation but has not been published. Refer to the upstream commit references for technical details.

Detection Methods for CVE-2026-68377

Indicators of Compromise

KASAN reports in kernel logs containing slab-use-after-free in dst_release with call traces through skb_release_head_state and rcuref_put
Unexpected kernel oops or panic messages referencing net/sched/act_tunnel_key.c or tunnel_key_release_params
Repeated tc action add/replace/delete operations targeting tunnel_key from unprivileged processes

Detection Strategies

Audit tc command invocations and netlink RTM_NEWACTION messages targeting the tunnel_key action module
Monitor for processes creating user namespaces followed by rapid traffic control configuration changes
Enable KASAN or KFENCE on canary hosts to catch memory safety violations during testing

Monitoring Recommendations

Collect kernel ring buffer and dmesg output centrally and alert on BUG: KASAN and general protection fault entries
Track unshare and clone syscalls with CLONE_NEWUSER correlated with subsequent netlink activity
Baseline legitimate tc usage per host and flag deviations from expected orchestration patterns

How to Mitigate CVE-2026-68377

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced in the commit list and reboot affected systems
Restrict CAP_NET_ADMIN inside user namespaces by setting kernel.unprivileged_userns_clone=0 where feasible
Prioritize patching hosts that permit local logins, container workloads, or multi-tenant execution

Patch Information

The fix defers dst_release() to the RCU callback so that both the params struct and its embedded dst are released only after the RCU grace period completes. Apply one of the upstream commits appropriate for your kernel branch: Linux Kernel Commit 2200a00, Linux Kernel Commit 2791a50, Linux Kernel Commit 531dbb5, Linux Kernel Commit f1f5c8a, or Linux Kernel Commit fed1b1d.

Workarounds

Disable the act_tunnel_key module where not required by removing CONFIG_NET_ACT_TUNNEL_KEY or blacklisting act_tunnel_key
Prevent unprivileged user namespace creation to eliminate the primary path to CAP_NET_ADMIN for local users
Apply seccomp or Landlock policies to block tc/netlink action calls from untrusted workloads

bash

# Configuration example
# Block unprivileged user namespaces (removes CAP_NET_ADMIN path for local users)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-68377.conf

# Prevent the vulnerable module from loading
echo 'blacklist act_tunnel_key' > /etc/modprobe.d/blacklist-act_tunnel_key.conf
rmmod act_tunnel_key 2>/dev/null || true