UBUNTU-CVE-2026-99167: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput() tcfactionput() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in tcfactionput+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Hold the action IDR mutex across both the reference-count and binding-count updates and IDR removal, keeping cleanup outside the lock.
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
The issue requires concurrent action reference and binding-count updates such that another thread can free the traffic-control action after its reference count is decremented but before its binding count is updated.
What indicates that a system may have encountered this issue?
KASAN can report a slab use-after-free in __tcf_action_put(), involving a write of size 4. The reported task may be tc-put-pause, although the data does not establish that this task name is required for exploitation.
What does the fix change?
The fix holds the action IDR mutex across both counter updates and IDR removal, preventing another thread from freeing the action during the vulnerable interval. Cleanup is kept outside that lock.