CVE-2026-99167

net/sched: fix use-after-free in __tcf_action_put()

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in __tcf_action_put()

__tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as:

BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64

Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	16af6067392c40e454e49eec834843ab03643d96 to before 4d83a3fc03bc595dd39b79ad61288738fbb1f2baAffected 16af6067392c40e454e49eec834843ab03643d96 to before fd01abed2568209f7daaf60e5ee68ae4a4744f48Affected 16af6067392c40e454e49eec834843ab03643d96 to before fcc7d734ceccfab8ec3398c5b34f8e775d459507Affected 16af6067392c40e454e49eec834843ab03643d96 to before fde33eb9955d819af282d5f5e84684eaec248291Affected 16af6067392c40e454e49eec834843ab03643d96 to before 969ad6f2b266f383b44194d50d15631969b26222Affected 16af6067392c40e454e49eec834843ab03643d96 to before 2465d27ef90de9105c2bffb6c35f8ce08918e642Affected 16af6067392c40e454e49eec834843ab03643d96 to before 2e012e431aa271ef3c84206f48854f539c03bff0Affected 16af6067392c40e454e49eec834843ab03643d96 to before 7b16eb911091aae237a8673da94e4dfb9cd21d54Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.161 through 6.6.Not affected 6.12.115 through 6.12.Not affected 6.18.59 through 6.18.Not affected 7.2.13 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

16af6067392c40e454e49eec834843ab03643d96 to before 4d83a3fc03bc595dd39b79ad61288738fbb1f2baAffected
16af6067392c40e454e49eec834843ab03643d96 to before fd01abed2568209f7daaf60e5ee68ae4a4744f48Affected
16af6067392c40e454e49eec834843ab03643d96 to before fcc7d734ceccfab8ec3398c5b34f8e775d459507Affected
16af6067392c40e454e49eec834843ab03643d96 to before fde33eb9955d819af282d5f5e84684eaec248291Affected
16af6067392c40e454e49eec834843ab03643d96 to before 969ad6f2b266f383b44194d50d15631969b26222Affected
16af6067392c40e454e49eec834843ab03643d96 to before 2465d27ef90de9105c2bffb6c35f8ce08918e642Affected
16af6067392c40e454e49eec834843ab03643d96 to before 2e012e431aa271ef3c84206f48854f539c03bff0Affected
16af6067392c40e454e49eec834843ab03643d96 to before 7b16eb911091aae237a8673da94e4dfb9cd21d54Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.161 through 6.6.*Not affected
6.12.115 through 6.12.*Not affected
6.18.59 through 6.18.*Not affected
7.2.13 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.