CVE-2026-99167

A flaw was found in the Linux kernel's traffic control (net/sched) subsystem. Due to improper synchronization in the __tcf_action_put() function, reference and binding counts are updated out of sequence during action cleanup, allowing memory to be released while still being accessed. A local attacker could exploit this race condition to cause a use-after-free error, potentially resulting in local privilege escalation or a Denial of Service (DoS) via a system crash.

This vulnerability is rated as Important because an authenticated local user can trigger kernel memory corruption to escalate privileges to root or crash the host system, compromising kernel integrity without requiring physical access or user interaction. Standard Red Hat Enterprise Linux deployments include the traffic control scheduling subsystem by default, making the issue accessible in typical environments. Although local authentication is required, the potential for full kernel execution and complete loss of host availability justifies the Important severity classification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.