CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Only allow actct to bind to clsact/ingress qdiscs and shared blocks
As Paolo said earlier [1]:
"Since the blamed commit below, classify can return TCACTCONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet."
actct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TCACTCONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing actct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach actct to egress (albeit only with clsact).
[1]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the net/sched change that restricts act_ct so it can only bind to clsact/ingress qdiscs (and shared blocks), because act_ct was never meant to be used in the egress path and some users attach it to egress today.
Linux kernel net/sched (act_ct / clsact ingress qdiscs) allow act_ct binding = only clsact/ingress qdiscs (and shared blocks); disallow binding act_ct to egress
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23270?
CVE-2026-23270 has a moderate severity rating due to the potential for unauthorized access to network traffic management.
How do I fix CVE-2026-23270?
To fix CVE-2026-23270, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2026-23270?
CVE-2026-23270 affects certain versions of the Linux kernel that implement network scheduling features.
Can CVE-2026-23270 lead to exploitation?
Yes, CVE-2026-23270 could potentially allow an attacker to manipulate network traffic if left unpatched.
What should I do if I am using an affected version of the Linux kernel regarding CVE-2026-23270?
If you are using an affected version of the Linux kernel, you should immediately update to a secure version to mitigate the risk associated with CVE-2026-23270.