CVE-2026-68138

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: serialize qdisc_rtab_list against concurrent get/put<br /> <br /> qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly<br /> linked list qdisc_rtab_list and a plain non-atomic &amp;#39;int refcnt&amp;#39; with no<br /> lock. This was only safe because every caller historically held the RTNL<br /> mutex, which serialized all rate-table lookups, inserts and frees.<br /> <br /> That invariant no longer holds. cls_flower sets<br /> TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false<br /> for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through<br /> tcf_exts_validate_ex() -&gt; tcf_action_init() -&gt; tcf_action_init_1() -&gt;<br /> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the<br /> RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each<br /> adding a flower filter with a police action carrying the same rate, then<br /> race on qdisc_rtab_list and on the non-atomic refcnt, leading to a<br /> use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.<br /> qdisc_rtab_list is a single global (not per-netns), so the corrupted<br /> object is shared system-wide.<br /> <br /> BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160<br /> qdisc_put_rtab+0x12f/0x160<br /> tcf_police_init+0xda9/0x1590<br /> tcf_action_init_1+0x460/0x6b0<br /> tcf_action_init+0x439/0xa40<br /> tcf_exts_validate_ex+0x42d/0x550<br /> fl_change+0xddd/0x7da0<br /> tc_new_tfilter+0xaa7/0x2420<br /> rtnetlink_rcv_msg+0x95e/0xe90<br /> which belongs to the cache kmalloc-2k of size 2048<br /> <br /> Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The<br /> (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before<br /> taking the lock; if a concurrent inserter added an identical table in the<br /> meantime the freshly allocated one is freed under the lock, so no<br /> duplicate is leaked. qdisc_put_rtab() now decrements the refcount and<br /> unlinks under the same lock.