High · published March 18, 2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
As Paolo said earlier [1]:
"Since the blamed commit below, classify can return TC_ACT_CONSUMED while
the current skb being held by the defragmentation engine. As reported by
GangMin Kim, if such packet is that may cause a UaF when the defrag engine
later on tries to tuch again such packet."
act_ct was never meant to be used in the egress path, however some users
are attaching it to egress today [2]. Attempting to reach a middle
ground, we noticed that, while most qdiscs are not handling
TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we
address the issue by only allowing act_ct to bind to clsact/ingress
qdiscs and shared blocks. That way it's still possible to attach act_ct to
egress (albeit only with clsact).
[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/
[2] https://lore.kernel.org/netdev/[email protected]/
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.15.148, < 5.15.203 | 5.15.203 |
| linux/linux_kernel | ≥ 6.1.75, < 6.1.167 | 6.1.167 |
| linux/linux_kernel | ≥ 6.6.14, < 6.6.130 | 6.6.130 |
| linux/linux_kernel | ≥ 6.7.2, < 6.8 | 6.8 |
| linux/linux_kernel | ≥ 6.8, < 6.12.77 | 6.12.77 |
| linux/linux_kernel | ≥ 6.13, < 6.18.18 | 6.18.18 |
| linux/linux_kernel | ≥ 6.19, < 6.19.8 | 6.19.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |