High · published March 18, 2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_gate: snapshot parameters with RCU on replace
The gate action can be replaced while the hrtimer callback or dump path is
walking the schedule list.
Convert the parameters to an RCU-protected snapshot and swap updates under
tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits
the entry list, preserve the existing schedule so the effective state is
unchanged.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.8.1, < 5.10.253 | 5.10.253 |
| linux/linux_kernel | ≥ 5.11, < 6.1.167 | 6.1.167 |
| linux/linux_kernel | ≥ 6.2, < 6.6.130 | 6.6.130 |
| linux/linux_kernel | ≥ 6.7, < 6.12.78 | 6.12.78 |
| linux/linux_kernel | ≥ 6.13, < 6.18.18 | 6.18.18 |
| linux/linux_kernel | ≥ 6.19, < 6.19.8 | 6.19.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |