CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft

In the Linux kernel, the following vulnerability has been resolved:

net/sched: actct: Only release RCU read lock after ctft

When looking up a flow table in actct in tcfctflowtableget(), rhashtablelookupfast() internally opens and closes an RCU read critical section before returning ctft. The tcfctflowtablecleanupwork() can complete before refcountincnotzero() is invoked on the returned ctft resulting in a UAF on the already freed ctft object. This vulnerability can lead to privilege escalation.

Analysis from zdi-disclosures@trendmicro.com: When initializing actct, tcfctinit() is called, which internally triggers tcfctflowtableget().

static int tcfctflowtableget(struct net net, struct tcfctparams params)

{ struct zoneshtkey key = { .net = net, .zone = params->zone }; struct tcfctflowtable ctft; int err = -ENOMEM;

mutexlock(&zonesmutex); ctft = rhashtablelookupfast(&zonesht, &key, zonesparams); // [1] if (ctft && refcountincnotzero(&ctft->ref)) // [2] goto outunlock; ... }

static alwaysinline void rhashtablelookupfast( struct rhashtable ht, const void key, const struct rhashtableparams params) { void obj;

rcureadlock(); obj = rhashtablelookup(ht, key, params); rcureadunlock();

return obj; }

At [1], rhashtablelookupfast() looks up and returns the corresponding ctft from zonesht . The lookup is performed within an RCU read critical section through rcureadlock() / rcureadunlock(), which prevents the object from being freed. However, at the point of function return, rcureadunlock() has already been called, and there is nothing preventing ctft from being freed before reaching refcountincnotzero(&ctft->ref) at [2]. This interval becomes the race window, during which ctft can be freed.

Free Process:

tcfctflowtableput() is executed through the path tcfctcleanup() callrcu() tcfctparamsfreercu() tcfctparamsfree() tcfctflowtableput().

static void tcfctflowtableput(struct tcfctflowtable ctft) { if (refcountdecandtest(&ctft->ref)) { rhashtableremovefast(&zonesht, &ctft->node, zonesparams); INITRCUWORK(&ctft->rwork, tcfctflowtablecleanupwork); // [3] queuercuwork(actctwq, &ctft->rwork); } }

At [3], tcfctflowtablecleanupwork() is scheduled as RCU work

static void tcfctflowtablecleanupwork(struct workstruct work)

{ struct tcfctflowtable ctft; struct flowblock block;

ctft = containerof(torcuwork(work), struct tcfctflowtable, rwork); nfflowtablefree(&ctft->nfft); block = &ctft->nfft.flowblock; downwrite(&ctft->nfft.flowblocklock); WARNON(!listempty(&block->cblist)); upwrite(&ctft->nfft.flowblocklock); kfree(ctft); // [4]

moduleput(THISMODULE); }

tcfctflowtablecleanupwork() frees ctft at [4]. When this function executes between [1] and [2], UAF occurs.

This race condition has a very short race window, making it generally difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was inserted after[1]