CVE-2026-68138

A flaw was found in the Linux kernel's networking scheduler component. A race condition exists in the handling of rate tables (qdisc_rtab_list) due to a lack of proper locking during concurrent operations. A local attacker could exploit this by sending specially crafted network filter requests, leading to a use-after-free or double-free vulnerability. This could result in a system-wide denial of service.

This vulnerability is rated as an Important impact because a local user with the ability to configure network traffic control policies can trigger kernel memory corruption across the entire host, potentially causing a kernel panic or privilege escalation. Although manipulating traffic filters typically requires administrative capabilities like CAP_NET_ADMIN, environments that permit unprivileged user namespaces allow unprivileged users to reach the vulnerable unlocked path. Because the affected rate table list is allocated globally rather than isolated per namespace, the resulting memory corruption compromises system stability system-wide.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.