CVE-2026-68138net/sched: serialize qdisc_rtab_list against concurrent get/put
- 7.8HighCVSS base score
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < 1b050d09dd1a0ddae83bf012cf4956b7a960235f
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < 6e0241f6cbb149d926ee8efee2c734fea71452cf
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < f93c89392bd3b180b5b7abc6fdae8e3dd667a313
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < 4131dd0b6f67acddd616ed7c244e1d3eedd46e7b
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < d981098b76756ed71666a27518eeb69883657c43
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < 8ddc2eb0d2da9c83f54f1e5720525b461b8480c4
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < fb29e1b41052488ee3f2d115d4a870497ebd7f7d
- affected 470502de5bdb1ed0def643a4458593a40b8f6b66 – < f43ee0c0730d6191629b5ee1ceae27b1ebfdc047
- affected 5.1
- unaffected < 5.1
- unaffected 5.10.266 – ≤ 5.10.*
- unaffected 5.15.217 – ≤ 5.15.*
- unaffected 6.1.184 – ≤ 6.1.*
- unaffected 6.6.153 – ≤ 6.6.*
- unaffected 6.12.105 – ≤ 6.12.*
- unaffected 6.18.46 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/1b050d09dd1a0ddae83bf012cf4956b7a960235f (opens in a new tab)
- https://git.kernel.org/stable/c/6e0241f6cbb149d926ee8efee2c734fea71452cf (opens in a new tab)
- https://git.kernel.org/stable/c/f93c89392bd3b180b5b7abc6fdae8e3dd667a313 (opens in a new tab)
- https://git.kernel.org/stable/c/4131dd0b6f67acddd616ed7c244e1d3eedd46e7b (opens in a new tab)
- https://git.kernel.org/stable/c/d981098b76756ed71666a27518eeb69883657c43 (opens in a new tab)
- https://git.kernel.org/stable/c/8ddc2eb0d2da9c83f54f1e5720525b461b8480c4 (opens in a new tab)
- https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d (opens in a new tab)
- https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-55519 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68138)Record last updated .