{"id":"CVE-2026-99167","kind":"vulnerability","aliases":["CVE-2026-99167"],"related":[],"title":"Linux kernel: traffic-control action refcount race frees memory still in use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free the action between these operations,\ncausing the binding-count update to access freed memory. KASAN reports it\nas:\n\n  BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340\n  Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64\n\nHold the action IDR mutex across both counter updates and IDR removal,\nkeeping cleanup outside the lock.","summary":"In the Linux kernel's net/sched traffic-control code, __tcf_action_put() drops the reference count before the binding count, so another thread can free the action in between and the binding-count update writes to freed memory. The sources do not state the attacker's result beyond a KASAN-reported slab use-after-free write, so the impact on a running system is unknown.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Install a Linux kernel build that includes the upstream commit fixing __tcf_action_put() (the fix holds the action IDR mutex across both counter updates and IDR removal); the sources do not name the fixed kernel version.","status":"open","published_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:41+00:00","updated_at":"2026-10-28T11:35:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:35:41Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream commit fixing __tcf_action_put() (the fix holds the action IDR mutex across both counter updates and IDR removal); the sources do not name the fixed kernel version.","reach":"unknown","title":"Linux kernel: traffic-control action refcount race frees memory still in use","impact":"high","summary":"In the Linux kernel's net/sched traffic-control code, __tcf_action_put() drops the reference count before the binding count, so another thread can free the action in between and the binding-count update writes to freed memory. The sources do not state the attacker's result beyond a KASAN-reported slab use-after-free write, so the impact on a running system is unknown.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption via slab use-after-free write; code execution possible","analyst_note":"Check the NVD entry and the upstream kernel stable commit for the fixed kernel versions and whether unprivileged users can reach the tc action path.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel without this fix that use net/sched traffic-control actions. The sources do not say which configurations or user privileges trigger the race, so unknown who can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3427,"output_tokens":523,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':162C '-2026':15A,18A '-99167':16A,19A '/64':177C '4':167C 'access':144C 'across':183C 'action':6A,38B,54B,114C,117C,133C,160C,180C 'addr':169C 'anoth':49B,128C 'attack':73B 'beyond':76B 'bind':46B,60B,126C,140C 'binding-count':59B,139C 'bug':151C 'caus':137C 'cleanup':191C 'code':36B 'control':5A,35B 'count':43B,47B,61B,122C,127C,141C 'counter':185C 'cve':14A,17A 'decrement':119C,124C 'drop':40B 'ff11000000d46420':170C 'fix':107C 'follow':101C 'free':9A,52B,85B,111C,131C,157C 'freed':65B,145C 'hold':178C 'host':26B 'idr':181C,188C 'impact':89B 'infrastructur':20B 'kasan':79B,147C,152C 'kasan-report':78B 'keep':190C 'kernel':2A,23B,30B,99C 'linux':1A,22B,29B,98C 'linux-kernel':21B 'lock':194C 'memori':10A,66B,146C 'mutex':182C 'net/sched':32B,106C 'oper':136C 'outsid':192C 'paus':176C 'put':39B,115C,118C,161C,175C 'race':8A 'refcount':7A 'refer':42B,121C 'remov':189C 'report':80B,148C 'resolv':105C 'result':75B 'run':92B 'self':25B 'self-host':24B 'size':166C 'slab':81B,154C 'slab-use-after-fre':153C 'sourc':68B 'state':71B 'still':11A 'system':93B 'task':172C 'tc':174C 'tc-put-paus':173C 'tcf':37B,113C,116C,159C 'thread':50B,129C 'traffic':4A,34B 'traffic-control':3A,33B 'unknown':95B 'updat':62B,142C,186C 'use':13A,83B,109C,155C 'use-after-fre':82B,108C 'vulner':102C 'write':63B,86B,164C 'x327/0x340':163C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel without this fix that use net/sched traffic-control actions. The sources do not say which configurations or user privileges trigger the race, so unknown who can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99167","severity":null,"published_at":"2026-10-28T11:17:37+00:00","modified_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}