CVE-2026-46319

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: act_ct: Only release RCU read lock after ct_ft<br /> <br /> When looking up a flow table in act_ct in tcf_ct_flow_table_get(),<br /> rhashtable_lookup_fast() internally opens and closes an RCU read critical<br /> section before returning ct_ft.<br /> The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()<br /> is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft<br /> object. This vulnerability can lead to privilege escalation.<br /> <br /> Analysis from zdi-disclosures@trendmicro.com:<br /> When initializing act_ct, tcf_ct_init() is called, which internally triggers<br /> tcf_ct_flow_table_get().<br /> <br /> static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)<br /> <br /> {<br /> struct zones_ht_key key = { .net = net, .zone = params-&gt;zone };<br /> struct tcf_ct_flow_table *ct_ft;<br /> int err = -ENOMEM;<br /> <br /> mutex_lock(&amp;zones_mutex);<br /> ct_ft = rhashtable_lookup_fast(&amp;zones_ht, &amp;key, zones_params); // [1]<br /> if (ct_ft &amp;&amp; refcount_inc_not_zero(&amp;ct_ft-&gt;ref)) // [2]<br /> goto out_unlock;<br /> ...<br /> }<br /> <br /> static __always_inline void *rhashtable_lookup_fast(<br /> struct rhashtable *ht, const void *key,<br /> const struct rhashtable_params params)<br /> {<br /> void *obj;<br /> <br /> rcu_read_lock();<br /> obj = rhashtable_lookup(ht, key, params);<br /> rcu_read_unlock();<br /> <br /> return obj;<br /> }<br /> <br /> At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft<br /> from zones_ht . The lookup is performed within an RCU read critical section<br /> through rcu_read_lock() / rcu_read_unlock(), which prevents the object from<br /> being freed. However, at the point of function return, rcu_read_unlock() has<br /> already been called, and there is nothing preventing ct_ft from being freed<br /> before reaching refcount_inc_not_zero(&amp;ct_ft-&gt;ref) at [2]. This interval becomes<br /> the race window, during which ct_ft can be freed.<br /> <br /> Free Process:<br /> <br /> tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()<br /> tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().<br /> <br /> static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)<br /> {<br /> if (refcount_dec_and_test(&amp;ct_ft-&gt;ref)) {<br /> rhashtable_remove_fast(&amp;zones_ht, &amp;ct_ft-&gt;node, zones_params);<br /> INIT_RCU_WORK(&amp;ct_ft-&gt;rwork, tcf_ct_flow_table_cleanup_work); // [3]<br /> queue_rcu_work(act_ct_wq, &amp;ct_ft-&gt;rwork);<br /> }<br /> }<br /> <br /> At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work<br /> <br /> static void tcf_ct_flow_table_cleanup_work(struct work_struct *work)<br /> <br /> {<br /> struct tcf_ct_flow_table *ct_ft;<br /> struct flow_block *block;<br /> <br /> ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,<br /> rwork);<br /> nf_flow_table_free(&amp;ct_ft-&gt;nf_ft);<br /> block = &amp;ct_ft-&gt;nf_ft.flow_block;<br /> down_write(&amp;ct_ft-&gt;nf_ft.flow_block_lock);<br /> WARN_ON(!list_empty(&amp;block-&gt;cb_list));<br /> up_write(&amp;ct_ft-&gt;nf_ft.flow_block_lock);<br /> kfree(ct_ft); // [4]<br /> <br /> module_put(THIS_MODULE);<br /> }<br /> <br /> tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes<br /> between [1] and [2], UAF occurs.<br /> <br /> This race condition has a very short race window, making it generally<br /> difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was<br /> inserted after[1]