CVE-2026-23413

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> clsact: Fix use-after-free in init/destroy rollback asymmetry<br /> <br /> Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.<br /> The latter is achieved by first fully initializing a clsact instance, and<br /> then in a second step having a replacement failure for the new clsact qdisc<br /> instance. clsact_init() initializes ingress first and then takes care of the<br /> egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon<br /> failure, the kernel will trigger the clsact_destroy() callback.<br /> <br /> Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the<br /> way how the transition is happening. If tcf_block_get_ext on the q-&gt;ingress_block<br /> ends up failing, we took the tcx_miniq_inc reference count on the ingress<br /> side, but not yet on the egress side. clsact_destroy() tests whether the<br /> {ingress,egress}_entry was non-NULL. However, even in midway failure on the<br /> replacement, both are in fact non-NULL with a valid egress_entry from the<br /> previous clsact instance.<br /> <br /> What we really need to test for is whether the qdisc instance-specific ingress<br /> or egress side previously got initialized. This adds a small helper for checking<br /> the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon<br /> clsact_destroy() in order to fix the use-after-free scenario. Convert the<br /> ingress_destroy() side as well so both are consistent to each other.