---
id: "CVE-2026-99167"
kind: "vulnerability"
aliases: ["CVE-2026-99167"]
title: "Linux kernel: traffic-control action refcount race frees memory still in use"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "self-hosted"]
not_affected_if: []
published_at: "2026-10-28T11:17:37+00:00"
first_seen_at: "2026-10-28T11:32:36+00:00"
updated_at: "2026-10-28T11:35:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99167", "first_seen_at": "2026-10-28T11:32:36+00:00"}]
---

# Linux kernel: traffic-control action refcount race frees memory still in use

In the Linux kernel's net/sched traffic-control code, __tcf_action_put() drops the reference count before the binding count, so another thread can free the action in between and the binding-count update writes to freed memory. The sources do not state the attacker's result beyond a KASAN-reported slab use-after-free write, so the impact on a running system is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Install a Linux kernel build that includes the upstream commit fixing __tcf_action_put() (the fix holds the action IDR mutex across both counter updates and IDR removal); the sources do not name the fixed kernel version.

## Timeline

- 2026-10-28T11:32:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99167

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in __tcf_action_put()

__tcf_action_put() decrements the reference count before decrementing the
binding count. Another thread can free the action between these operations,
causing the binding-count update to access freed memory. KASAN reports it
as:

  BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340
  Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64

Hold the action IDR mutex across both counter updates and IDR removal,
keeping cleanup outside the lock.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_