CVE-2026-23245: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23245 is a race condition vulnerability in the Linux kernel's net/sched subsystem, specifically in the act_gate (gate action scheduler) component. The flaw allows a local user with traffic control (tc) modification privileges to trigger a use-after-free or memory corruption condition by replacing the gate action while the hrtimer callback or dump path is concurrently walking the schedule list. Affected Linux kernel versions span from 5.8 through multiple stable branches up to (but not including) 5.10.253, 6.1.167, 6.6.130, 6.12.78, 6.18.18, and 6.19.8, as well as Microsoft Azure Linux 3 (azl3_kernel prior to 6.6.126.1-1). It was disclosed on March 18, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla, Microsoft MSRC).

The root cause is a race condition (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the act_gate module of the Linux kernel's traffic control (net/sched) subsystem. When a gate action is replaced via a REPLACE operation, the hrtimer callback or a concurrent dump path may still be iterating over the schedule list, leading to unsafe concurrent access to unprotected parameters and potential kernel memory corruption. The fix converts the gate action parameters into an RCU-protected snapshot, swaps updates atomically under tcf_lock, and frees the previous snapshot safely via call_rcu(); when a REPLACE omits the entry list, the existing schedule is preserved to maintain consistent state. Exploitation requires local access and the CAP_NET_ADMIN capability to manipulate traffic control policies (Red Hat Bugzilla, Kernel Patches).

Successful exploitation can result in kernel memory corruption, enabling a local attacker to achieve arbitrary code execution at the kernel level or crash the system (denial of service). Because exploitation grants kernel-level privileges, an attacker could escalate from a low-privileged local user to full root access, potentially compromising the entire host, all running containers, and any data accessible to the system. The confidentiality, integrity, and availability impacts are all rated High (Red Hat Advisory, Microsoft MSRC).

Update the Linux kernel to one of the following patched stable versions: 5.10.253+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.18+, or 6.19.8+. Microsoft Azure Linux 3 users should update to azl3_kernel 6.6.126.1-1 or later. As a configuration-based workaround, restrict the CAP_NET_ADMIN capability to trusted administrators only and enforce strict access controls on tc command execution to limit exposure. Debian, SUSE, Amazon Linux 2023, and other downstream distributions have issued their own kernel security updates incorporating these fixes (Red Hat Advisory, Kernel Patches, Microsoft MSRC).

The vulnerability was reported via the standard Linux kernel CVE announcement process by Greg Kroah-Hartman on the linux-cve-announce mailing list. Red Hat opened a security tracking bug (Bugzilla #2448593) on the same day as disclosure. No notable independent researcher commentary, social media discussion, or significant media coverage has been identified beyond routine vulnerability database and advisory tracking.