CVE-2026-53011

A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advance_sched() function. This happens because a pointer to an old schedule entry is still used after the memory for that entry has been queued for release. An attacker could potentially exploit this memory corruption to cause a denial of service or achieve arbitrary code execution.

A use after free in the taprio qdisc schedule switch path occurs because advance_sched can keep next pointing to an entry from the old oper schedule after switch_schedules queues that old schedule for RCU freeing. The stale entry is then written through next end_time and published as q current_entry, creating a kernel memory corruption candidate rather than a pure warning. For the CVSS the PR:L is used for the paranoid score because taprio setup normally needs CAP_NET_ADMIN, but this capability can be delegated to a container root or network management service account rather than full host root. The issue is not directly network reachable and is triggered through local control plane qdisc configuration, not by remote packet traffic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.