net/sched: fix use-after-free in __tcf_action_put()

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.

Timeline

1. Oct 28, 2026, 10:35 AM UTCCVE published
2. Oct 28, 2026, 10:41 AM UTCFirst seen by cve.now
3. Oct 30, 2026, 12:42 PM UTCRecord last updated

Affected versions

• Linux Linux

  Version range not reported

• Linux Linux

  4.19

• KernelLinux

  From 4.19.0 · fixed in 6.18.59; From 6.19.0 · fixed in 7.2.13

References 8