{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nclsact: Fix use-after-free in init\/destroy rollback asymmetry\\n\\nFix a use-after-free in the clsact qdisc upon init\/destroy rollback asymmetry.\\nThe latter is achieved by first fully initializing a clsact instance, and\\nthen in a second step having a replacement failure for the new clsact qdisc\\ninstance. clsact_init() initializes ingress first and then takes care of the\\negress part. This can fail midway, for example, via tcf_block_get_ext(). Upon\\nfailure, the kernel will trigger the clsact_destroy() callback.\\n\\nCommit 1cb6f0bae504 (\\”bpf: Fix too early release of tcx_entry\\”) details the\\nway how the transition is happening. If tcf_block_get_ext on the q-\\u003eingress_block\\nends up failing, we took the tcx_miniq_inc reference count on the ingress\\nside, but not yet on the egress side. clsact_destroy() tests whether the\\n{ingress,egress}_entry was non-NULL. However, even in midway failure on the\\nreplacement, both are in fact non-NULL with a valid egress_entry from the\\nprevious clsact instance.\\n\\nWhat we really need to test for is whether the qdisc instance-specific ingress\\nor egress side previously got initialized. This adds a small helper for checking\\nthe miniq initialization called mini_qdisc_pair_inited, and utilizes that upon\\nclsact_destroy() in order to fix the use-after-free scenario. Convert the\\ningress_destroy() side as well so both are consistent to each other.”,”published”:”2026-04-02T11:40:54.384Z”,”modified”:”2026-04-27T14:02:12.056Z”,”type”:”cve”,”title”:”clsact: Fix use-after-free in init\/destroy rollback asymmetry”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/a73d95b57bf9faebdfed591bcb7ed9292062a84c\\nhttps:\/\/git.kernel.org\/stable\/c\/37bef86e5428d59f70a4da82b80f9a8f252fecbe\\nhttps:\/\/git.kernel.org\/stable\/c\/4c9af67f99aa3e51b522c54968ab3ac8272be41c\\nhttps:\/\/git.kernel.org\/stable\/c\/0509b762bc5e8ea7b8391130730c6d8502fc6e69\\nhttps:\/\/git.kernel.org\/stable\/c\/a0671125d4f55e1e98d9bde8a0b671941987e208″,”id”:”CVE-2026-23413″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 230bb13650b0f186f540500fd5f5f7096a822a2a\\nLinux Linux 1cb6f0bae50441f4b4b32a28315853b279c7404e\\nLinux Linux 1cb6f0bae50441f4b4b32a28315853b279c7404e\\nLinux Linux 1cb6f0bae50441f4b4b32a28315853b279c7404e\\nLinux Linux 1cb6f0bae50441f4b4b32a28315853b279c7404e\\nLinux Linux f61ecf1bd5b562ebfd7d430ccb31619857e80857\\nLinux Linux 6.10″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”230bb13650b0f186f540500fd5f5f7096a822a2a”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nclsact: Fix use-after-free in init\/destroy rollback asymmetry\\n\\nFix a use-after-free in the clsact qdisc upon init\/destroy rollback…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-49708","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n