From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36C922EA75E for ; Tue, 9 Jun 2026 12:11:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781007087; cv=none; b=mkXJV2AbA+AmtGAVd6zoeMYU0zgTENHu3Wyem8yEgI+azSo1FXEdvUzGMR1C7UJfg2RIN9h/4xPMWVrMCPMb58+0id+DQm177kTVAYhFC6EP2bqz+ulKmq+ptwCUvjlxNXnIyVabS0HSRMja1doxGpl/by4katQxF3M+ACfuKQ0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781007087; c=relaxed/simple; bh=YL947VHTaApPdj52v6hhVN+Id/ssxYqOxiS9KsCRz0U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nsYhkiuDSK9X9g9SJrcQY5PHeou34DO6gm7fiX0K336GCoZ7okBNx8WM5UIlHS3DXympiK37v4oKI8jnkQ6O9raP3u8xHh8Jt5fvwCfBjpKK55ohr9U9AAj2xoxMS8a1A3yPKpO42r5O7nln4jZX7W0VRRyMjX1KTcca1jtThKA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TEF/R25c; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TEF/R25c" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80FE01F00893; Tue, 9 Jun 2026 12:11:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781007086; bh=sZgxx5CebeXIisTK3UFw1S4Ggk6hveEAoCAHq2ERkDQ=; h=From:To:Cc:Subject:Date:Reply-To; b=TEF/R25cCB/xpAd9ccWnAAmmLvMPxBifpsg+A/9jqGAGDZ67E74b2WxXPjK4vnwFz mrWYj/LtJlz4K5RuyIEJjfUqfBnDxTqS+GhMWFU1v/igcF6Bfr7xpEfwwuOXtlz6Wa LJD6CSpddnky1lW4tbnn3Ze5ML2sVInkRuJa5fbw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft Date: Tue, 9 Jun 2026 14:10:25 +0200 Message-ID: <2026060925-CVE-2026-46319-ab3d@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6754; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1CBuhOnZ3j+1b/4mra/SQFZLhgRwKG+UABxFv5lHR7s=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkaTBsd6v1u1aw107i5ceKWa10/LP5tq1u2f271hjldb uzi+50ed8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBETOcwLLg49eKZFNXa8H1K GovOFBY6NNfvP8Awm+3bMdFtbRX7Tqucyv+iuuCeZvbErwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... } static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj; rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_read_unlock(); return obj; } At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft from zones_ht . The lookup is performed within an RCU read critical section through rcu_read_lock() / rcu_read_unlock(), which prevents the object from being freed. However, at the point of function return, rcu_read_unlock() has already been called, and there is nothing preventing ct_ft from being freed before reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes the race window, during which ct_ft can be freed. Free Process: tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu() tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put(). static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft) { if (refcount_dec_and_test(&ct_ft->ref)) { rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); // [3] queue_rcu_work(act_ct_wq, &ct_ft->rwork); } } At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) { struct tcf_ct_flow_table *ct_ft; struct flow_block *block; ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, rwork); nf_flow_table_free(&ct_ft->nf_ft); block = &ct_ft->nf_ft.flow_block; down_write(&ct_ft->nf_ft.flow_block_lock); WARN_ON(!list_empty(&block->cb_list)); up_write(&ct_ft->nf_ft.flow_block_lock); kfree(ct_ft); // [4] module_put(THIS_MODULE); } tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes between [1] and [2], UAF occurs. This race condition has a very short race window, making it generally difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was inserted after[1] The Linux kernel CVE team has assigned CVE-2026-46319 to this issue. Affected and fixed versions =========================== Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 5.10.258 with commit ece578ca61e572df96cfc80456357ebfae0b4b9e Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 5.15.209 with commit a2e0c045c87aa252eb61412e67dd91f2c2b19f81 Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 6.1.175 with commit 67c9ecc9f2575273ed1323e312881fc98ac83d6d Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 6.6.141 with commit f23424a0ddadb494d4bd57056a7ca703312d3a7b Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 6.12.91 with commit 17dfb67cb399b660105d9a8c6100851c0d0cdc70 Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 6.18.33 with commit 4c727c6967a41b37efe0f26332ca9ec5b74785a3 Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 7.0.10 with commit 3e20e1b3058e0b94638e7b931c138e840e266724 Issue introduced in 5.7 with commit 138470a9b2cc2e26e6018300394afc3858a54e6a and fixed in 7.1-rc1 with commit f462dca0c8415bf0058d0ffa476354c4476d0f09 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-46319 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sched/act_ct.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/ece578ca61e572df96cfc80456357ebfae0b4b9e https://git.kernel.org/stable/c/a2e0c045c87aa252eb61412e67dd91f2c2b19f81 https://git.kernel.org/stable/c/67c9ecc9f2575273ed1323e312881fc98ac83d6d https://git.kernel.org/stable/c/f23424a0ddadb494d4bd57056a7ca703312d3a7b https://git.kernel.org/stable/c/17dfb67cb399b660105d9a8c6100851c0d0cdc70 https://git.kernel.org/stable/c/4c727c6967a41b37efe0f26332ca9ec5b74785a3 https://git.kernel.org/stable/c/3e20e1b3058e0b94638e7b931c138e840e266724 https://git.kernel.org/stable/c/f462dca0c8415bf0058d0ffa476354c4476d0f09