CVE-2026-64530: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64530 is a use-after-free (UAF) vulnerability in the Linux kernel's traffic control (tc) scheduler, specifically in the tcf_qevent_handle() function within net/sched/cls_api.c. The flaw was disclosed on July 26, 2026, and affects Linux kernel versions 5.15.148–5.15.211, 6.1.75–6.1.177, 6.6.14–6.6.144, 6.7.2–6.7.x, and 6.8 through unpatched stable releases. Patches are available in versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No official CVSS score has been published yet; Feedly estimates the severity as Medium (Feedly, GitHub Advisory).

The root cause is a missing TC_ACT_CONSUMED return code handler in tcf_qevent_handle() (CWE-416: Use After Free). When tcf_classify() returns TC_ACT_CONSUMED — which occurs when an skb (socket buffer) is held by the defragmentation engine (e.g., act_ct processing out-of-order IP fragments) — ownership of the skb transfers away from the caller. However, tcf_qevent_handle() falls through its switch statement and returns the skb to the caller as if classification succeeded. The RED qdisc, the only qdisc currently wiring up qevents, then continues to operate on the freed skb — enqueueing it, dropping it, or updating statistics — resulting in a UAF condition. The vulnerable code path is triggered by a specific tc configuration: a RED qdisc with a qevent block using act_ct with connection tracking defragmentation enabled, combined with out-of-order fragmented traffic (e.g., a fragmented UDP stream) (Feedly, GitHub Advisory).

Successful exploitation can cause a kernel crash (denial of service) or potentially allow local privilege escalation via arbitrary kernel code execution, depending on the memory state at the time of the UAF. The vulnerability requires local access with privileges to configure traffic control rules, limiting the attack surface to users or processes with CAP_NET_ADMIN or equivalent capabilities. Data integrity and system availability are the primary concerns, as kernel memory corruption can destabilize the entire system (Feedly).

1. Gain local access: Obtain a local shell on a vulnerable Linux system with CAP_NET_ADMIN privileges (e.g., as root or within a privileged network namespace).
2. Configure RED qdisc with qevent: Set up a RED qdisc on a network interface with a qevent block: tc qdisc add dev eth0 root handle 1: red limit 1000000 min 30000 max 90000 avpkt 1000 burst 55 probability 0.1 bandwidth 10Mbit qevent early_drop block 10.
3. Attach act_ct filter with defragmentation: Add a tc filter to the qevent block using the ct action with connection tracking and defragmentation enabled: tc filter add block 10 protocol ip pref 1 flower action ct.
4. Generate out-of-order fragmented traffic: Send fragmented UDP or IP traffic to the interface in an out-of-order sequence (e.g., using Scapy or a custom tool) so that act_ct holds the skb in the defragmentation engine and tcf_classify() returns TC_ACT_CONSUMED.
5. Trigger UAF: The tcf_qevent_handle() function returns the consumed skb to red_enqueue(), which operates on the freed memory, causing a kernel crash or memory corruption exploitable for privilege escalation (Feedly).

• Logs: Kernel oops or BUG messages in dmesg or /var/log/kern.log referencing net/sched/cls_api.c, tcf_qevent_handle, or red_enqueue; KASAN (Kernel Address Sanitizer) reports indicating use-after-free in the networking scheduler subsystem.
• Network: Unusual tc qdisc configurations on interfaces combining RED qdiscs with qevent blocks and act_ct filters; unexpected fragmented UDP or IP traffic streams directed at monitored interfaces.
• Process: Unexpected use of tc commands by non-administrative users or processes; processes running in privileged network namespaces configuring qdiscs with act_ct actions.

Apply the kernel patches released on July 26, 2026, which add proper TC_ACT_CONSUMED handling in tcf_qevent_handle() to return NULL without touching the skb. Fixed versions include 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1 (GitHub Advisory). As a workaround until patching is possible: restrict CAP_NET_ADMIN privileges to trusted administrators only; avoid configuring RED qdisc qevents with act_ct (connection tracking with defragmentation); or disable IP defragmentation in connection tracking rules where feasible.