CVE-2026-74700 Overview
CVE-2026-74700 is a use-after-free vulnerability in the Linux kernel's net/sched/cls_api.c traffic classifier subsystem. The flaw affects unlocked classifier operations where tcf_proto_destroy() runs without holding rtnl_lock. A race between two concurrent tc_new_tfilter requests creating filters of different kinds (for example, u32 and flower) in the same chain and priority can drop the last reference to a tcf_proto outside RTNL context. The resulting destroy path triggers a slab use-after-free in kernel memory. The fix acquires rtnl_lock around tp->ops->destroy() for locked classifiers whenever RTNL is not already held.
Critical Impact
Local attackers with CAP_NET_ADMIN in a user or network namespace can trigger a kernel use-after-free that leads to memory corruption, privilege escalation, or denial of service.
Affected Products
- Linux kernel net/sched subsystem (cls_api.c)
- Distributions shipping affected upstream kernels prior to the referenced stable commits
- Systems exposing traffic control (tc) filter management to unprivileged namespaces
Discovery Timeline
- 2026-08-22 - CVE-2026-74700 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74700
Vulnerability Analysis
The vulnerability lives in the classifier API path tc_new_tfilter() in net/sched/cls_api.c. Linux traffic control supports unlocked classifier operations to improve scalability, meaning multiple filter creation requests can proceed concurrently without holding rtnl_lock. A narrow race window allows a tcf_proto structure created by one thread to be referenced and later destroyed by a completely unrelated thread that never acquired RTNL.
When two threads race to install filters of different kind values in the same chain and priority, one thread wins the tcf_chain_tp_insert_unique() insertion. The second thread performs tcf_chain_tp_find(), sees the winner's tcf_proto, takes a reference, then rejects it on the kind-mismatch check. The rejecting thread calls tcf_proto_put() on the foreign tcf_proto. If the original creator has already released its own references through its error path, the foreign thread drops the refcount to zero and invokes tp->ops->destroy() outside RTNL. This produces a KASAN slab-use-after-free during u32_init / u32_destroy teardown.
Root Cause
The root cause is asymmetric locking assumptions between classifier reference counting and destroy callbacks. Classifier destroy() implementations for u32, flow, bpf, cgroup, route, basic, fw, and mall assume RTNL is held or ignore the rtnl_held parameter. Reference release from an unrelated unlocked request violates this assumption.
Attack Vector
Exploitation requires local access with the ability to issue tc filter add netlink messages, typically via CAP_NET_ADMIN inside a user namespace. An attacker scripts concurrent RTM_NEWTFILTER requests with mismatched kind values against the same chain and priority to widen the race window. Successfully triggering the use-after-free enables kernel memory corruption suitable for local privilege escalation.
No verified public exploit code is available. See the upstream kernel fix commit for the exact code paths involved.
Detection Methods for CVE-2026-74700
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in u32_init, u32_destroy, tcf_proto_destroy, or tcf_proto_put on the call stack
- Unexpected kernel oops or panic messages originating in net/sched/cls_api.c around offsets near tc_new_tfilter
- Auditd records showing high-frequency, concurrent tc filter add operations from a single non-root UID inside a user namespace
Detection Strategies
- Enable CONFIG_KASAN on test and staging kernels to surface the use-after-free directly during fuzzing or regression runs
- Monitor dmesg and /var/log/kern.log for BUG reports mentioning cls_api, cls_u32, or cls_flower destroy paths
- Alert on netlink message rate anomalies for RTM_NEWTFILTER from unprivileged user namespaces
Monitoring Recommendations
- Ingest kernel logs into a central SIEM and create rules for KASAN and Oops signatures involving tcf_proto_destroy
- Track unusual unshare -Urn or containerized workloads issuing large volumes of tc commands
- Correlate kernel crashes with process ancestry to identify potential exploit attempts
How to Mitigate CVE-2026-74700
Immediate Actions Required
- Upgrade to a stable Linux kernel that includes the fix commits referenced by the kernel.org stable tree
- Restrict CAP_NET_ADMIN in unprivileged user namespaces on multi-tenant hosts and container platforms
- Audit container runtimes and Kubernetes node configurations to disable unneeded user namespace creation
Patch Information
The upstream fix modifies tcf_proto_destroy() to acquire rtnl_lock around tp->ops->destroy() for locked classifiers when RTNL is not already held. Apply vendor kernel updates that backport the following commits: 34e77d8e3570, a347304b2ca1, a81f9c44d87f, b648c8a56531, and d6222af7274f.
Workarounds
- Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where operationally acceptable
- Apply seccomp or AppArmor policies that block the RTM_NEWTFILTER netlink route for untrusted workloads
- Remove CAP_NET_ADMIN from container capability sets that do not require traffic control management
# Configuration example: reduce local kernel attack surface
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w user.max_user_namespaces=0
# Verify running kernel includes the fix (example - adjust for your distro)
uname -r
grep -i 'cls_api' /proc/kallsyms | head
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
