CVE-2026-23270: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23270 is a use-after-free (UaF) vulnerability in the Linux kernel's network traffic control (tc) subsystem, specifically in the act_ct (connection tracking) action module. The flaw occurs when act_ct is attached to queueing disciplines (qdiscs) other than clsact/ingress, causing the defragmentation engine to access already-freed packet buffers. It was disclosed on March 18, 2026, and affects multiple Linux kernel version ranges including 5.15.148–5.15.203, 6.1.75–6.1.167, 6.6.14–6.6.130, 6.7.2–6.8, 6.8–6.12.77, 6.13–6.18.18, and 6.19–6.19.8. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel's net/sched subsystem. When act_ct returns TC_ACT_CONSUMED on the egress path, it signals that the socket buffer (skb) is consumed by the defragmentation engine; however, most qdiscs (other than clsact/ingress) do not properly handle this return code. As a result, the qdisc may continue to reference the skb after it has been released, and when the defrag engine later attempts to access the same packet, a use-after-free condition is triggered. The fix restricts act_ct binding exclusively to clsact/ingress qdiscs and shared blocks, which correctly handle TC_ACT_CONSUMED. The issue was originally reported by GangMin Kim and discussed on the Linux netdev mailing list (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can allow a local attacker with CAP_NET_ADMIN privileges to trigger a use-after-free in kernel memory, potentially leading to arbitrary code execution with kernel-level privileges, privilege escalation, or denial of service. The confidentiality, integrity, and availability impacts are all rated High, meaning a successful exploit could result in full system compromise, including access to sensitive kernel data and disruption of system stability (Red Hat Bugzilla, Red Hat Advisory).

1. Privilege Acquisition: Obtain a local account with CAP_NET_ADMIN privileges (e.g., via a container with elevated capabilities, or a user with sudo access to network configuration tools).
2. Identify Vulnerable Kernel: Confirm the target system is running a vulnerable kernel version (e.g., 5.15.148–5.15.202, 6.1.75–6.1.166, 6.6.14–6.6.129, 6.8–6.12.76, 6.13–6.18.17, or 6.19–6.19.7).
3. Attach act_ct to Non-clsact Qdisc: Use tc (traffic control) commands to attach the act_ct action to an egress qdisc that does not handle TC_ACT_CONSUMED (e.g., a standard pfifo or htb qdisc on an egress hook).
4. Trigger Packet Fragmentation: Send or route fragmented network packets through the interface so that act_ct processes them and returns TC_ACT_CONSUMED, placing the skb under the defragmentation engine's control.
5. Trigger Use-After-Free: The non-clsact qdisc fails to handle TC_ACT_CONSUMED and continues to reference the freed skb; when the defrag engine subsequently accesses the same packet, the use-after-free is triggered, potentially allowing kernel memory corruption and privilege escalation (Red Hat Bugzilla).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing net/sched, act_ct, or use-after-free errors; KASAN (Kernel Address Sanitizer) reports involving skb or nf_ct structures.
• Process: Unexpected processes invoking tc (traffic control) commands to modify qdisc or filter rules on network interfaces, especially attaching act_ct to egress qdiscs.
• Network: Unusual traffic control rule configurations visible via tc qdisc show or tc filter show that attach act_ct to non-clsact/ingress qdiscs.
• File System: Unexpected kernel module loads or modifications to network configuration scripts that persist tc rules across reboots (e.g., in /etc/network/interfaces, /etc/sysconfig/network-scripts/, or systemd network units).

Apply the upstream kernel patches available for the following fixed versions: 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.18, and 6.19.8. Red Hat has issued multiple errata addressing this vulnerability across RHEL 8, 9, and 10 (RHSA-2026:13565, RHSA-2026:13566, RHSA-2026:19568, RHSA-2026:19569, RHSA-2026:21209, RHSA-2026:21706, RHSA-2026:21745, and others). SUSE, Debian, Amazon Linux 2023, and other distributions have also released updated kernel packages. As a workaround, restrict CAP_NET_ADMIN privileges to trusted users only, as this capability is required to configure the tc rules that trigger the vulnerability (Red Hat Bugzilla, Red Hat Advisory).

Red Hat rated this vulnerability as Medium severity and tracked it through multiple errata across RHEL 8, 9, and 10 product lines, indicating broad distribution-level attention. The issue was originally surfaced on the Linux netdev mailing list by Paolo Abeni (Red Hat) and reported by GangMin Kim, reflecting active upstream community engagement. No significant independent researcher commentary or notable social media discussion beyond standard vulnerability tracking has been observed (Red Hat Bugzilla).