---
id: CVE-2026-23413
title: 'clsact: Fix use-after-free in init/destroy rollback asymmetry'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  clsact: Fix use-after-free in init/destroy rollback asymmetry

  Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.
  The latter is achieved by …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 230bb13650b0f186f540500fd5f5f7096a822a2a <
    a73d95b57bf9faebdfed591bcb7ed9292062a84c
  - >-
    Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e <
    37bef86e5428d59f70a4da82b80f9a8f252fecbe
  - >-
    Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e <
    4c9af67f99aa3e51b522c54968ab3ac8272be41c
  - >-
    Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e <
    0509b762bc5e8ea7b8391130730c6d8502fc6e69
  - >-
    Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e <
    a0671125d4f55e1e98d9bde8a0b671941987e208
  - Linux f61ecf1bd5b562ebfd7d430ccb31619857e80857
  - Linux >= 6.6.41 < 6.6.130
  - Linux >= 6.9.10 < 6.10
  - Linux 6.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:07:46.676905Z'
published: '2026-04-02'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:55.294Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23413'
references:
  - url: 'https://git.kernel.org/stable/c/a73d95b57bf9faebdfed591bcb7ed9292062a84c'
  - url: 'https://git.kernel.org/stable/c/37bef86e5428d59f70a4da82b80f9a8f252fecbe'
  - url: 'https://git.kernel.org/stable/c/4c9af67f99aa3e51b522c54968ab3ac8272be41c'
  - url: 'https://git.kernel.org/stable/c/0509b762bc5e8ea7b8391130730c6d8502fc6e69'
  - url: 'https://git.kernel.org/stable/c/a0671125d4f55e1e98d9bde8a0b671941987e208'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01652
ingestedAt: '2026-10-16T17:24:46.644Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

clsact: Fix use-after-free in init/destroy rollback asymmetry

Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.
The latter is achieved by first fully initializing a clsact instance, and
then in a second step having a replacement failure for the new clsact qdisc
instance. clsact_init() initializes ingress first and then takes care of the
egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon
failure, the kernel will trigger the clsact_destroy() callback.

Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the
way how the transition is happening. If tcf_block_get_ext on the q->ingress_block
ends up failing, we took the tcx_miniq_inc reference count on the ingress
side, but not yet on the egress side. clsact_destroy() tests whether the
{ingress,egress}_entry was non-NULL. However, even in midway failure on the
replacement, both are in fact non-NULL with a valid egress_entry from the
previous clsact instance.

What we really need to test for is whether the qdisc instance-specific ingress
or egress side previously got initialized. This adds a small helper for checking
the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon
clsact_destroy() in order to fix the use-after-free scenario. Convert the
ingress_destroy() side as well so both are consistent to each other.

## Affected

- `Linux >= 230bb13650b0f186f540500fd5f5f7096a822a2a < a73d95b57bf9faebdfed591bcb7ed9292062a84c`
- `Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e < 37bef86e5428d59f70a4da82b80f9a8f252fecbe`
- `Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e < 4c9af67f99aa3e51b522c54968ab3ac8272be41c`
- `Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e < 0509b762bc5e8ea7b8391130730c6d8502fc6e69`
- `Linux >= 1cb6f0bae50441f4b4b32a28315853b279c7404e < a0671125d4f55e1e98d9bde8a0b671941987e208`
- `Linux f61ecf1bd5b562ebfd7d430ccb31619857e80857`
- `Linux >= 6.6.41 < 6.6.130`
- `Linux >= 6.9.10 < 6.10`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.