CVE-2026-64530

A flaw was found in the Linux kernel's traffic control (TC) classifier application programming interface (API). The tcf_qevent_handle function does not properly handle a consumed socket buffer (skb) when it is processed by the defragmentation engine. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been freed. An attacker could potentially exploit this to cause system instability or execute arbitrary code.

This Important flaw in the Linux kernel's networking scheduler can lead to a use-after-free vulnerability. Exploitation requires a local attacker to configure specific tc qdisc and tc filter rules involving RED qdisc with early drop events and connection tracking on fragmented network traffic. This non-default configuration limits the attack surface, but successful exploitation could lead to privilege escalation or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring the Linux kernel's traffic control (tc) subsystem with the RED queue discipline (red) that includes qevent early_drop and an action ct filter on interfaces processing fragmented UDP streams. This specific configuration is required to trigger the use-after-free vulnerability.