CVE-2026-46319 (GCVE-0-2026-46319)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:11 – Updated: 2026-06-14 18:08
VLAI
Title
net/sched: act_ct: Only release RCU read lock after ct_ft
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... } static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj; rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_read_unlock(); return obj; } At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft from zones_ht . The lookup is performed within an RCU read critical section through rcu_read_lock() / rcu_read_unlock(), which prevents the object from being freed. However, at the point of function return, rcu_read_unlock() has already been called, and there is nothing preventing ct_ft from being freed before reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes the race window, during which ct_ft can be freed. Free Process: tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu() tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put(). static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft) { if (refcount_dec_and_test(&ct_ft->ref)) { rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); // [3] queue_rcu_work(act_ct_wq, &ct_ft->rwork); } } At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) { struct tcf_ct_flow_table *ct_ft; struct flow_block *block; ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, rwork); nf_flow_table_free(&ct_ft->nf_ft); block = &ct_ft->nf_ft.flow_block; down_write(&ct_ft->nf_ft.flow_block_lock); WARN_ON(!list_empty(&block->cb_list)); up_write(&ct_ft->nf_ft.flow_block_lock); kfree(ct_ft); // [4] module_put(THIS_MODULE); } tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes between [1] and [2], UAF occurs. This race condition has a very short race window, making it generally difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was inserted after[1]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < ece578ca61e572df96cfc80456357ebfae0b4b9e (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < a2e0c045c87aa252eb61412e67dd91f2c2b19f81 (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < 67c9ecc9f2575273ed1323e312881fc98ac83d6d (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < f23424a0ddadb494d4bd57056a7ca703312d3a7b (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < 17dfb67cb399b660105d9a8c6100851c0d0cdc70 (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < 4c727c6967a41b37efe0f26332ca9ec5b74785a3 (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < 3e20e1b3058e0b94638e7b931c138e840e266724 (git)
Affected: 138470a9b2cc2e26e6018300394afc3858a54e6a , < f462dca0c8415bf0058d0ffa476354c4476d0f09 (git)
Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ece578ca61e572df96cfc80456357ebfae0b4b9e",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "a2e0c045c87aa252eb61412e67dd91f2c2b19f81",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "67c9ecc9f2575273ed1323e312881fc98ac83d6d",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "f23424a0ddadb494d4bd57056a7ca703312d3a7b",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "17dfb67cb399b660105d9a8c6100851c0d0cdc70",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "4c727c6967a41b37efe0f26332ca9ec5b74785a3",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "3e20e1b3058e0b94638e7b931c138e840e266724",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            },
            {
              "lessThan": "f462dca0c8415bf0058d0ffa476354c4476d0f09",
              "status": "affected",
              "version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: Only release RCU read lock after ct_ft\n\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\nsection before returning ct_ft.\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\nobject. This vulnerability can lead to privilege escalation.\n\nAnalysis from zdi-disclosures@trendmicro.com:\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\ntcf_ct_flow_table_get().\n\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\n\n{\n                struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\n                struct tcf_ct_flow_table *ct_ft;\n                int err = -ENOMEM;\n\n                mutex_lock(\u0026zones_mutex);\n                ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\n                if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\n                                goto out_unlock;\n                ...\n}\n\nstatic __always_inline void *rhashtable_lookup_fast(\n                struct rhashtable *ht, const void *key,\n                const struct rhashtable_params params)\n{\n                void *obj;\n\n                rcu_read_lock();\n                obj = rhashtable_lookup(ht, key, params);\n                rcu_read_unlock();\n\n                return obj;\n}\n\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\nfrom zones_ht . The lookup is performed within an RCU read critical section\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\nbeing freed. However, at the point of function return, rcu_read_unlock() has\nalready been called, and there is nothing preventing ct_ft from being freed\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\nthe race window, during which ct_ft can be freed.\n\nFree Process:\n\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\n\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\n{\n                if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\n                                rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\n                                INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\n                                queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\n                }\n}\n\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\n\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\n\n{\n                struct tcf_ct_flow_table *ct_ft;\n                struct flow_block *block;\n\n                ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\n                                                                rwork);\n                nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\n                block = \u0026ct_ft-\u003enf_ft.flow_block;\n                down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n                WARN_ON(!list_empty(\u0026block-\u003ecb_list));\n                up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n                kfree(ct_ft); // [4]\n\n                module_put(THIS_MODULE);\n}\n\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\nbetween [1] and [2], UAF occurs.\n\nThis race condition has a very short race window, making it generally\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\ninserted after[1]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T18:08:57.070Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ece578ca61e572df96cfc80456357ebfae0b4b9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2e0c045c87aa252eb61412e67dd91f2c2b19f81"
        },
        {
          "url": "https://git.kernel.org/stable/c/67c9ecc9f2575273ed1323e312881fc98ac83d6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f23424a0ddadb494d4bd57056a7ca703312d3a7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/17dfb67cb399b660105d9a8c6100851c0d0cdc70"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c727c6967a41b37efe0f26332ca9ec5b74785a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e20e1b3058e0b94638e7b931c138e840e266724"
        },
        {
          "url": "https://git.kernel.org/stable/c/f462dca0c8415bf0058d0ffa476354c4476d0f09"
        }
      ],
      "title": "net/sched: act_ct: Only release RCU read lock after ct_ft",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46319",
    "datePublished": "2026-06-09T12:11:12.128Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-06-14T18:08:57.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46319",
      "date": "2026-07-23",
      "epss": "0.00125",
      "percentile": "0.02608"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-17T14:46:23.000Z",
      "cve": "CVE-2026-46319",
      "id": "msrc_CVE-2026-46319",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: act_ct: Only release RCU read lock after ct_ft",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46319.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46319\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-09T13:16:37.210\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: act_ct: Only release RCU read lock after ct_ft\\n\\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\\nsection before returning ct_ft.\\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\\nobject. This vulnerability can lead to privilege escalation.\\n\\nAnalysis from zdi-disclosures@trendmicro.com:\\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\\ntcf_ct_flow_table_get().\\n\\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\\n\\n{\\n                struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\\n                struct tcf_ct_flow_table *ct_ft;\\n                int err = -ENOMEM;\\n\\n                mutex_lock(\u0026zones_mutex);\\n                ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\\n                if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\\n                                goto out_unlock;\\n                ...\\n}\\n\\nstatic __always_inline void *rhashtable_lookup_fast(\\n                struct rhashtable *ht, const void *key,\\n                const struct rhashtable_params params)\\n{\\n                void *obj;\\n\\n                rcu_read_lock();\\n                obj = rhashtable_lookup(ht, key, params);\\n                rcu_read_unlock();\\n\\n                return obj;\\n}\\n\\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\\nfrom zones_ht . The lookup is performed within an RCU read critical section\\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\\nbeing freed. However, at the point of function return, rcu_read_unlock() has\\nalready been called, and there is nothing preventing ct_ft from being freed\\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\\nthe race window, during which ct_ft can be freed.\\n\\nFree Process:\\n\\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\\n\\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\\n{\\n                if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\\n                                rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\\n                                INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\\n                                queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\\n                }\\n}\\n\\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\\n\\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\\n\\n{\\n                struct tcf_ct_flow_table *ct_ft;\\n                struct flow_block *block;\\n\\n                ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\\n                                                                rwork);\\n                nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\\n                block = \u0026ct_ft-\u003enf_ft.flow_block;\\n                down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\\n                WARN_ON(!list_empty(\u0026block-\u003ecb_list));\\n                up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\\n                kfree(ct_ft); // [4]\\n\\n                module_put(THIS_MODULE);\\n}\\n\\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\\nbetween [1] and [2], UAF occurs.\\n\\nThis race condition has a very short race window, making it generally\\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\\ninserted after[1]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet/sched: act_ct: Solo liberar el bloqueo de lectura RCU despu\u00e9s de ct_ft\\n\\nAl buscar una tabla de flujo en act_ct en tcf_ct_flow_table_get(), rhashtable_lookup_fast() abre y cierra internamente una secci\u00f3n cr\u00edtica de lectura RCU antes de devolver ct_ft.\\nLa tcf_ct_flow_table_cleanup_work() puede completarse antes de que se invoque refcount_inc_not_zero() sobre el ct_ft devuelto, lo que resulta en un UAF en el objeto ct_ft ya liberado. Esta vulnerabilidad puede conducir a la escalada de privilegios.\\n\\nAn\u00e1lisis de zdi-disclosures@trendmicro.com:\\nAl inicializar act_ct, se llama a tcf_ct_init(), lo que internamente dispara tcf_ct_flow_table_get().\\n\\nstatic int tcf_ct_flow_table_get(struct net net, struct tcf_ct_params params)\\n\\n{\\n                struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\\n                struct tcf_ct_flow_table ct_ft;\\n                int err = -ENOMEM;\\n\\n                mutex_lock(\u0026zones_mutex);\\n                ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\\n                if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\\n                                goto out_unlock;\\n                ...\\n}\\n\\nstatic __always_inline void rhashtable_lookup_fast(\\n                struct rhashtable ht, const void key,\\n                const struct rhashtable_params params)\\n{\\n                void obj;\\n\\n                rcu_read_lock();\\n                obj = rhashtable_lookup(ht, key, params);\\n                rcu_read_unlock();\\n\\n                return obj;\\n}\\n\\nEn [1], rhashtable_lookup_fast() busca y devuelve el ct_ft correspondiente de zones_ht. La b\u00fasqueda se realiza dentro de una secci\u00f3n cr\u00edtica de lectura RCU a trav\u00e9s de rcu_read_lock() / rcu_read_unlock(), lo que evita que el objeto sea liberado. Sin embargo, en el punto de retorno de la funci\u00f3n, rcu_read_unlock() ya ha sido llamado, y no hay nada que impida que ct_ft sea liberado antes de alcanzar refcount_inc_not_zero(\u0026ct_ft-\u003eref) en [2]. Este intervalo se convierte en la ventana de carrera, durante la cual ct_ft puede ser liberado.\\n\\nProceso de Liberaci\u00f3n:\\n\\ntcf_ct_flow_table_put() se ejecuta a trav\u00e9s de la ruta tcf_ct_cleanup() call_rcu() tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\\n\\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table ct_ft)\\n{\\n                if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\\n                                rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\\n                                INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\\n                                queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\\n                }\\n}\\n\\nEn [3], tcf_ct_flow_table_cleanup_work() se programa como trabajo RCU\\n\\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct work)\\n\\n{\\n                struct tcf_ct_flow_table ct_ft;\\n                struct flow_block block;\\n\\n                ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\\n                                                                rwork);\\n                nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\\n                block = \u0026ct_ft-\u003enf_ft.flow_block;\\n                down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\\n                WARN_ON(!list_empty(\u0026block-\u003ecb_list));\\n                up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\\n                kfree(ct_ft); // [4]\\n\\n                module_put(THIS_MODULE);\\n}\\n\\ntcf_ct_flow_table_cleanup_work() libera ct_ft en [4]. Cuando esta funci\u00f3n se ejecuta entre [1] y [2], ocurre un UAF.\\n\\nEsta condici\u00f3n de carrera tiene una ventana de carrera muy corta, lo que la hace generalmente dif\u00edcil de activar. Por lo tanto, para activar la vulnerabilidad se insert\u00f3 un msleep(100) despu\u00e9s de [1].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/act_ct.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"ece578ca61e572df96cfc80456357ebfae0b4b9e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"a2e0c045c87aa252eb61412e67dd91f2c2b19f81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"67c9ecc9f2575273ed1323e312881fc98ac83d6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"f23424a0ddadb494d4bd57056a7ca703312d3a7b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"17dfb67cb399b660105d9a8c6100851c0d0cdc70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"4c727c6967a41b37efe0f26332ca9ec5b74785a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"3e20e1b3058e0b94638e7b931c138e840e266724\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"138470a9b2cc2e26e6018300394afc3858a54e6a\",\"lessThan\":\"f462dca0c8415bf0058d0ffa476354c4476d0f09\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/act_ct.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.91\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7\",\"versionEndExcluding\":\"5.10.258\",\"matchCriteriaId\":\"33983DD1-6F5C-4A20-A9AF-24DABFA46B60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"919C10A9-7951-4A74-BADD-C135A0A8D8B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.141\",\"matchCriteriaId\":\"97A9FFFA-22BB-4D5C-9790-5A2286E392F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.91\",\"matchCriteriaId\":\"C918746B-DE6F-448F-A93E-A04C5481688D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"96D99E49-380D-43AB-BDBA-25C3AD018A9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17dfb67cb399b660105d9a8c6100851c0d0cdc70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e20e1b3058e0b94638e7b931c138e840e266724\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c727c6967a41b37efe0f26332ca9ec5b74785a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/67c9ecc9f2575273ed1323e312881fc98ac83d6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2e0c045c87aa252eb61412e67dd91f2c2b19f81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ece578ca61e572df96cfc80456357ebfae0b4b9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f23424a0ddadb494d4bd57056a7ca703312d3a7b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f462dca0c8415bf0058d0ffa476354c4476d0f09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-27T16:25:41+00:00",
      "cve": "CVE-2026-46319",
      "id": "CVE-2026-46319",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_ct: Only release RCU read lock after ct_ft",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46319.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T23:53:19Z",
      "cve": "CVE-2026-46319",
      "id": "CVE-2026-46319",
      "initial_release_date": "2026-06-10T02:25:52Z",
      "product_status:first_fixed": "68",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "91",
      "product_status:recommended": "316",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46319",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46319.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.