CVE-2026-64530: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64530 is a use-after-free (UAF) vulnerability in the Linux kernel's traffic control (TC) subsystem, specifically in tcf_qevent_handle() within net/sched/cls_api.c. The flaw arises because tcf_qevent_handle() fails to handle the TC_ACT_CONSUMED return value from tcf_classify(), causing callers such as the RED qdisc to continue operating on a socket buffer (skb) they no longer own. It was published on July 26, 2026, and affects Linux kernel versions 5.15.148–5.15.211, 6.1.75–6.1.177, 6.6.14–6.6.144, and 6.7.2–6.7.x (before 6.8), as well as certain stable git commit ranges. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Microsoft MSRC).

The root cause is classified as CWE-825 (Expired Pointer Dereference). When tcf_classify() returns TC_ACT_CONSUMED — which occurs when an skb is held by the defragmentation engine (e.g., act_ct processing out-of-order IP fragments) — the skb ownership is transferred to the defrag engine and must not be accessed again by the caller. However, tcf_qevent_handle() lacked a case for TC_ACT_CONSUMED in its switch statement, causing it to fall through and return the skb to the caller as if classification had succeeded. The RED qdisc, which is the only qdisc wiring up qevents (via qe_mark on RED_PROB_MARK/HARD_MARK and qe_early_drop on congestion drop), would then enqueue, drop, or update statistics on the freed skb, resulting in a UAF condition. The fix treats TC_ACT_CONSUMED the same as TC_ACT_STOLEN — returning NULL without touching or freeing the skb (GitHub Advisory).

Successful exploitation can cause a kernel use-after-free condition, leading to system crashes (denial of service) or memory corruption on affected Linux hosts. An unauthenticated network attacker can trigger this by sending specially crafted out-of-order fragmented traffic (e.g., fragmented UDP streams) to a system configured with a RED qdisc using qevents and act_ct with connection tracking defragmentation enabled. Memory corruption could potentially be leveraged for privilege escalation or arbitrary code execution in the kernel context, though the primary demonstrated impact is denial of service (GitHub Advisory, Microsoft MSRC).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.173%, indicating a low probability of exploitation in the near term. Exploitation requires a specific kernel configuration: a RED qdisc with qevents configured, combined with act_ct traffic control filters with defragmentation enabled — a non-default but operationally plausible setup in network-intensive environments.

1. Reconnaissance: Identify target Linux systems (kernel versions 5.15.148–5.15.211, 6.1.75–6.1.177, 6.6.14–6.6.144, or 6.7.2–6.7.x) running a RED qdisc with qevents and act_ct with defragmentation enabled. This configuration can be inferred from network behavior or system exposure.
2. Verify configuration: Confirm the target has a setup equivalent to:

   tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10
   tc filter add block 10 ... action ct

   with connection tracking defragmentation (nf_defrag) active.
3. Craft fragmented traffic: Generate out-of-order IP/UDP fragments destined for the target interface. Tools such as fragroute, scapy, or custom packet generators can produce fragmented UDP streams with deliberately reordered fragments.
4. Trigger TC_ACT_CONSUMED: Send the crafted fragmented traffic to the target. When act_ct holds the skb for reassembly and returns TC_ACT_CONSUMED, the unpatched tcf_qevent_handle() falls through and returns the skb to the RED qdisc.
5. Induce UAF: The RED qdisc operates on the freed/stolen skb (enqueue, drop, or stat update), triggering the use-after-free condition, which can crash the kernel or corrupt memory (GitHub Advisory).

• Network: Unusual volumes of out-of-order or fragmented UDP/IP traffic directed at interfaces configured with RED qdisc and act_ct filters; fragmented traffic patterns inconsistent with normal application behavior.
• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg referencing net/sched/cls_api.c, tcf_qevent_handle, or red_enqueue; kernel BUG/WARN traces involving use-after-free in the TC subsystem.
• Process/System: Unexpected system reboots or kernel crashes; memory corruption symptoms such as random process crashes or filesystem errors following high-volume fragmented traffic ingestion.
• File System: Kernel crash dump files (e.g., /var/crash/) generated around the time of suspicious fragmented traffic events.

Patches have been released for the following stable kernel versions: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. Red Hat has issued advisories (RHSA-2026:47620, RHSA-2026:48222, RHSA-2026:49032, RHSA-2026:49033, RHSA-2026:49211, RHSA-2026:49212, RHSA-2026:49214) and Debian has addressed the issue in linux 7.1.5-1 and linux 6.12.100-1. As a workaround, disable or avoid configuring RED qdisc qevents (qe_mark, qe_early_drop) in combination with act_ct defragmentation in traffic control filter chains. Additionally, implementing network-edge filtering to block crafted fragmented traffic can reduce exposure until patching is complete (GitHub Advisory, Red Hat CVE, Microsoft MSRC).

The vulnerability attracted community attention on Reddit's r/linux, where users noted an unusually long list of high-scoring CVEs published around the same time (Reddit). Security news outlets including SecurityOnline.info and Slashdot covered the broader Debian 13 kernel security update that addressed this and 67 other vulnerabilities (Slashdot). The Western Australian Government's SOC issued an advisory flagging this as a critical Linux kernel vulnerability (WA SOC). No specific researcher commentary or vendor statements beyond patch releases have been identified.