CVE-2026-99167: net/sched: fix use-after-free in __tcf_action_put()
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix use-after-free in tcfactionput()
tcfactionput() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as:
BUG: KASAN: slab-use-after-free in tcfactionput+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64
Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Hold the action IDR mutex across both counter updates and IDR removal in __tcf_action_put(), keeping cleanup inside the lock to prevent another thread from freeing the action between operations.