CVE-2026-23413

A flaw was found in the Linux kernel's clsact qdisc. This use-after-free vulnerability occurs due to an asymmetry in the initialization and destruction rollback process. When a replacement clsact qdisc instance fails during initialization, the destroy callback is triggered without properly de-initializing the ingress or egress sides, leading to the reuse of freed memory. This can result in system instability or a denial of service.

The bug appears when clsact replacement fails partway through initialization and clsact_destroy runs with misleading non-NULL ingress/egress pointers. Traffic control changes that install clsact normally require privileges (CAP_NET_ADMIN). Denial of service or memory corruption from the UAF is the primary concern.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.