Live › vulnerability › CVE-2026-99167
Go to dashboardIn the Linux kernel's net/sched traffic-control code, __tcf_action_put() drops the reference count before the binding count, so another thread can free the action in between and the binding-count update writes to freed memory. The sources do not state the attacker's result beyond a KASAN-reported slab use-after-free write, so the impact on a running system is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel without this fix that use net/sched traffic-control actions. The sources do not say which configurations or user privileges trigger the race, so unknown who can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix use-after-free in __tcf_action_put()
__tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as:
BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64
Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
This page as .md · .json · in your agent: get_signal("CVE-2026-99167")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.