CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: fix use-after-free in __tcf_action_put()<br /> <br /> __tcf_action_put() decrements the reference count before decrementing the<br /> binding count. Another thread can free the action between these operations,<br /> causing the binding-count update to access freed memory. KASAN reports it<br /> as:<br /> <br /> BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340<br /> Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64<br /> <br /> Hold the action IDR mutex across both counter updates and IDR removal,<br /> keeping cleanup outside the lock.