CVE-2026-72338: net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload

In the Linux kernel, the following vulnerability has been resolved:

net/sched: actpedit: fix TOCTOU heap OOB write in tc offload

There is a TOCTOU race condition in flower lockless approach between sizing a flowrule buffer and filling it. zdi-disclosures@trendmicro.com reports: The clsflower classifier operates with TCFPROTOOPSDOITUNLOCKED (flchange runs without RTNL), while RTMNEWACTION holds RTNL, so the independent locking domains make the race reachable in practice. KASAN confirms: BUG: KASAN: slab-out-of-bounds in tcfpeditoffloadactsetup+0x81b/0x930 Write of size 4 at addr ffff888001f27520 by task poc-toctou/312 The buggy address is located 0 bytes to the right of allocated 288-byte region [ffff888001f27400, ffff888001f27520) (cache kmalloc-512)

Note: The result is a heap OOB write attacker-controlled content into the adjacent slab object (requires CAPNETADMIN).

The fix introduces reading tcfpnkeys under act->tcfalock in all places using a new tcfpeditnkeyslocked() which replaces the old tcfpeditnkeys(). Additionally we close the remaining TOCTOU window between the sizing read and the fill reads by more careful accounting. Rather than silently truncating the key count, which leads to incorrect action semantics offloaded to hardware and secondary OOB writes if the remaining capacity is zero or consumed by prior actions, we enforce remaining capacity checks and return -ENOSPC if the required space exceeds the remaining capacity.