CVE-2026-53011

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: taprio: fix use-after-free in advance_sched() on schedule switch<br /> <br /> In advance_sched(), when should_change_schedules() returns true,<br /> switch_schedules() is called to promote the admin schedule to oper.<br /> switch_schedules() queues the old oper schedule for RCU freeing via<br /> call_rcu(), but &amp;#39;next&amp;#39; still points into an entry of the old oper<br /> schedule. The subsequent &amp;#39;next-&gt;end_time = end_time&amp;#39; and<br /> rcu_assign_pointer(q-&gt;current_entry, next) are use-after-free.<br /> <br /> Fix this by selecting &amp;#39;next&amp;#39; from the new oper schedule immediately<br /> after switch_schedules(), and using its pre-calculated end_time.<br /> setup_first_end_time() sets the first entry&amp;#39;s end_time to<br /> base_time + interval when the schedule is installed, so the value<br /> is already correct.<br /> <br /> The deleted &amp;#39;end_time = sched_base_time(admin)&amp;#39; assignment was also<br /> harmful independently: it would overwrite the new first entry&amp;#39;s<br /> pre-calculated end_time with just base_time.