Linux kernel net/sched: Use-after-free in __tcf_action_put()
Summary
The traffic-control subsystem net/sched of the Linux kernel contains a use-after-free in __tcf_action_put(). The reference count is decremented before the binding count, so another thread can free the action in between and the binding count update then writes to freed memory. An attacker with local access and low privileges can exploit this for high impact on confidentiality, integrity and availability (CVSS 7.8), mainly as a local privilege escalation. It is not remotely exploitable by itself.
Affected
- Linux kernel from commit 16af6067 onwards, before the fix commits (CNA record also lists Linux 4.19 as affected)
- Stable branches before the fixed versions: 5.10 before 5.10.273, 5.15 before 5.15.224, 6.1 before 6.1.191, 6.6 before 6.6.161, 6.12 before 6.12.115, 6.18 before 6.18.59, 7.2 before 7.2.13
- Versions 7.3 and later: Unknown (the CNA range data is inconsistent)
- Distribution kernel versions: Unknown
Fixed in
- Upstream fixes: kernel.org stable commits 2465d27e, 2e012e43, 4d83a3fc, 7b16eb91, 969ad6f2, fcc7d734, fd01abed and fde33eb9
- Fixed stable kernels: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13 or later
- Distribution fixed versions: Unknown; check your distribution's security tracker
Workaround
Unknown. No workaround was found in any source; applying the kernel update is the only confirmed remediation.
Exploitation
- No known exploitation as of 29 October 2026
- No public exploit code indexed in Metasploit or Exploit-DB
- Not listed in CISA KEV
- EPSS about 0.18 % (percentile 8)
Our recommendation
- Identify Linux hosts running affected kernel branches and check your distribution's security tracker for fixed versions
- Apply vendor kernel updates in the next maintenance window, prioritising multi-user, shared, CI and container hosts
- Reboot after installing the kernel update, as the fix only takes effect in the running kernel
- Restrict local shell accounts on hosts that do not need them until patched
- Monitor distribution trackers and CISA KEV for changes in exploitation status
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 2465d27e git.kernel.org
- Linux kernel stable commit 2e012e43 git.kernel.org
- Linux kernel stable commit 4d83a3fc git.kernel.org
- Linux kernel stable commit 7b16eb91 git.kernel.org
- Ubuntu security tracker CVE-2026-99167 ubuntu.com
- Strix CVE-2026-99167 www.strix.ai
- OffSeq threat radar CVE-2026-99167 radar.offseq.com
- Debian CVE tracker CVE-2026-99167 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:58.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
NVD references (8)
- https://git.kernel.org/stable/c/2465d27ef90de9105c2bffb6c35f8ce08918e642
- https://git.kernel.org/stable/c/2e012e431aa271ef3c84206f48854f539c03bff0
- https://git.kernel.org/stable/c/4d83a3fc03bc595dd39b79ad61288738fbb1f2ba
- https://git.kernel.org/stable/c/7b16eb911091aae237a8673da94e4dfb9cd21d54
- https://git.kernel.org/stable/c/969ad6f2b266f383b44194d50d15631969b26222
- https://git.kernel.org/stable/c/fcc7d734ceccfab8ec3398c5b34f8e775d459507
- https://git.kernel.org/stable/c/fd01abed2568209f7daaf60e5ee68ae4a4744f48
- https://git.kernel.org/stable/c/fde33eb9955d819af282d5f5e84684eaec248291
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.