{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet\/sched: act_ct: Only release RCU read lock after ct_ft\\n\\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\\nsection before returning ct_ft.\\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\\nobject. This vulnerability can lead to privilege escalation.\\n\\nAnalysis from zdi-disclosures@trendmicro.com:\\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\\ntcf_ct_flow_table_get().\\n\\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\\n\\n{\\n struct zones_ht_key key = { .net = net, .zone = params-\\u003ezone };\\n struct tcf_ct_flow_table *ct_ft;\\n int err = -ENOMEM;\\n\\n mutex_lock(\\u0026zones_mutex);\\n ct_ft = rhashtable_lookup_fast(\\u0026zones_ht, \\u0026key, zones_params); \/\/ [1]\\n if (ct_ft \\u0026\\u0026 refcount_inc_not_zero(\\u0026ct_ft-\\u003eref)) \/\/ [2]\\n goto out_unlock;\\n …\\n}\\n\\nstatic __always_inline void *rhashtable_lookup_fast(\\n struct rhashtable *ht, const void *key,\\n const struct rhashtable_params params)\\n{\\n void *obj;\\n\\n rcu_read_lock();\\n obj = rhashtable_lookup(ht, key, params);\\n rcu_read_unlock();\\n\\n return obj;\\n}\\n\\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\\nfrom zones_ht . The lookup is performed within an RCU read critical section\\nthrough rcu_read_lock() \/ rcu_read_unlock(), which prevents the object from\\nbeing freed. However, at the point of function return, rcu_read_unlock() has\\nalready been called, and there is nothing preventing ct_ft from being freed\\nbefore reaching refcount_inc_not_zero(\\u0026ct_ft-\\u003eref) at [2]. This interval becomes\\nthe race window, during which ct_ft can be freed.\\n\\nFree Process:\\n\\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\\n\\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\\n{\\n if (refcount_dec_and_test(\\u0026ct_ft-\\u003eref)) {\\n rhashtable_remove_fast(\\u0026zones_ht, \\u0026ct_ft-\\u003enode, zones_params);\\n INIT_RCU_WORK(\\u0026ct_ft-\\u003erwork, tcf_ct_flow_table_cleanup_work); \/\/ [3]\\n queue_rcu_work(act_ct_wq, \\u0026ct_ft-\\u003erwork);\\n }\\n}\\n\\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\\n\\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\\n\\n{\\n struct tcf_ct_flow_table *ct_ft;\\n struct flow_block *block;\\n\\n ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\\n rwork);\\n nf_flow_table_free(\\u0026ct_ft-\\u003enf_ft);\\n block = \\u0026ct_ft-\\u003enf_ft.flow_block;\\n down_write(\\u0026ct_ft-\\u003enf_ft.flow_block_lock);\\n WARN_ON(!list_empty(\\u0026block-\\u003ecb_list));\\n up_write(\\u0026ct_ft-\\u003enf_ft.flow_block_lock);\\n kfree(ct_ft); \/\/ [4]\\n\\n module_put(THIS_MODULE);\\n}\\n\\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\\nbetween [1] and [2], UAF occurs.\\n\\nThis race condition has a very short race window, making it generally\\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\\ninserted after[1]”,”published”:”2026-06-09T12:11:12.128Z”,”modified”:”2026-06-14T04:30:13.452Z”,”type”:”cve”,”title”:”net\/sched: act_ct: Only release RCU read lock after ct_ft”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/ece578ca61e572df96cfc80456357ebfae0b4b9e\\nhttps:\/\/git.kernel.org\/stable\/c\/a2e0c045c87aa252eb61412e67dd91f2c2b19f81\\nhttps:\/\/git.kernel.org\/stable\/c\/67c9ecc9f2575273ed1323e312881fc98ac83d6d\\nhttps:\/\/git.kernel.org\/stable\/c\/f23424a0ddadb494d4bd57056a7ca703312d3a7b\\nhttps:\/\/git.kernel.org\/stable\/c\/17dfb67cb399b660105d9a8c6100851c0d0cdc70\\nhttps:\/\/git.kernel.org\/stable\/c\/4c727c6967a41b37efe0f26332ca9ec5b74785a3\\nhttps:\/\/git.kernel.org\/stable\/c\/3e20e1b3058e0b94638e7b931c138e840e266724\\nhttps:\/\/git.kernel.org\/stable\/c\/f462dca0c8415bf0058d0ffa476354c4476d0f09″,”id”:”CVE-2026-46319″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a\\nLinux Linux 5.7″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”138470a9b2cc2e26e6018300394afc3858a54e6a”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet\/sched: act_ct: Only release RCU read lock after ct_ft\\n\\nWhen looking up a flow table in act_ct…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-62550","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n