CVE-2026-64530

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle<br /> <br /> tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the<br /> defragmentation engine (e.g. act_ct on out-of-order fragments). When<br /> that happens the skb is no longer owned by the caller and must not be<br /> touched again.<br /> <br /> tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the<br /> switch and returned the skb to the caller as if classification had<br /> passed. The only qdisc that wires up qevents today is RED, via three call sites<br /> (qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)<br /> red_enqueue() was continuing to operate on an skb it no longer owns in this<br /> case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.<br /> <br /> tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10<br /> tc filter add block 10 ... action ct<br /> <br /> (with ct defrag enabled and traffic that produces out-of-order<br /> fragments, e.g. a fragmented UDP stream)<br /> <br /> Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress<br /> and egress fast paths do: treat it as stolen and return NULL without<br /> touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be<br /> dropped/freed here, as it is no longer owned by us.