CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: fix use-after-free in advancesched() on schedule switch
In advancesched(), when shouldchangeschedules() returns true, switchschedules() is called to promote the admin schedule to oper. switchschedules() queues the old oper schedule for RCU freeing via callrcu(), but 'next' still points into an entry of the old oper schedule. The subsequent 'next->endtime = endtime' and rcuassignpointer(q->currententry, next) are use-after-free.
Fix this by selecting 'next' from the new oper schedule immediately after switchschedules(), and using its pre-calculated endtime. setupfirstendtime() sets the first entry's endtime to basetime + interval when the schedule is installed, so the value is already correct.
The deleted 'endtime = schedbasetime(admin)' assignment was also harmful independently: it would overwrite the new first entry's pre-calculated endtime with just basetime.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
In advance_sched(), when should_change_schedules() returns true, select 'next' from the new operational schedule immediately after switch_schedules(), before call_rcu() or rcu_assign_pointer(q->current_entry, next), rather than using the pointer into the old operational schedule.