CVE-2026-23413: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23413 is a use-after-free vulnerability in the Linux kernel's clsact queuing discipline (qdisc) subsystem, arising from an init/destroy rollback asymmetry. It affects Linux kernel versions 6.6.41–6.6.129, 6.9.10–6.9.x, 6.10.1–6.12.77, 6.13–6.18.19, 6.19–6.19.9, as well as kernel 6.10 and 7.0-rc1 through rc7. The vulnerability was published on April 2, 2026, with patches made available the same day via the GitHub Security Advisory (GitHub Advisory) and subsequently via stable kernel commits. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is a use-after-free (CWE-416) in the clsact_init() and clsact_destroy() functions within the Linux kernel's traffic control subsystem. When clsact_init() fails midway during egress initialization (e.g., via tcf_block_get_ext()), the kernel triggers the clsact_destroy() callback. The destruction logic incorrectly checks for non-NULL {ingress,egress}_entry pointers rather than verifying whether the qdisc instance-specific ingress or egress sides were actually initialized in the current instance — meaning a valid egress_entry from a previous clsact instance can be erroneously freed and then accessed. The fix introduces a helper function mini_qdisc_pair_inited to properly track initialization state and applies it in clsact_destroy() (GitHub Advisory). The vulnerability is exploitable locally by a low-privileged user with access to tc (traffic control) commands (Feedly).

Successful exploitation can result in kernel memory corruption, leading to denial of service (system crash or hang) or potentially kernel-level code execution. Given the local attack vector and low privilege requirement, a compromised unprivileged user account on an affected system could leverage this flaw to escalate privileges, read or modify sensitive kernel memory, or destabilize the host. The confidentiality, integrity, and availability impacts are all rated High (Feedly, GitHub Advisory).

Apply the available stable kernel patches immediately. Fixed versions include Linux kernel 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5 or later (GitHub Advisory, Feedly). Specific upstream commits addressing the issue are: 0509b762bc5e, 37bef86e5428, 4c9af67f99aa, a0671125d4f5, and a73d95b57bf9. For systems where immediate patching is not feasible, restrict access to tc (traffic control) commands and the clsact qdisc to trusted administrators only, using SELinux, AppArmor, or capability restrictions (e.g., CAP_NET_ADMIN). SUSE has also released a security update (SUSE-SU-2026:1661-1) addressing this CVE (SUSE Advisory), and Amazon Linux 2023 has issued ALAS2023-2026-1594.

SUSE issued security advisories (SUSE-SU-2026:21241-1 and SUSE-SU-2026:1661-1) addressing this vulnerability in their kernel packages (SUSE Advisory). Amazon Linux 2023 also published an advisory (ALAS2023-2026-1594). The Yocto Project security mailing list discussed the issue across multiple messages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisories.