CVE-2026-74700

A flaw was found in the Linux kernel's traffic control classifier application programming interface (API). A race condition can occur during the destruction of locked classifiers, specifically within the tc_new_tfilter function. This race allows an unlocked classifier's request to prematurely decrement the reference count of a locked classifier's protocol object without proper locking. Consequently, this can lead to a use-after-free vulnerability, potentially resulting in system instability or denial of service.

A race in net sched classifier creation can let an unlocked classifier request lose tcf_chain_tp_insert_unique() and drop the last reference on a different locked classifier proto. The destroy callback can then run without rtnl_lock while locked classifier code such as u32_destroy expects rtnl protection, which can leave shared classifier state inconsistent and lead to a slab use after free later observed in u32_init(). For the CVSS the PR:L is used for the paranoid score because reliable triggering requires local code that can perform tc filter operations, typically CAP_NET_ADMIN or delegated net namespace control, but this is not full host administrator access in many deployments. The issue is not reachable by ordinary network packets and is triggered through local netlink control plane operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.