{"id":"CVE-2026-99167","title":"net/sched: fix use-after-free in __tcf_action_put()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free th…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 16af6067392c40e454e49eec834843ab03643d96 < 2465d27ef90de9105c2bffb6c35f8ce08918e642","Linux >= 16af6067392c40e454e49eec834843ab03643d96 < 2e012e431aa271ef3c84206f48854f539c03bff0","Linux >= 16af6067392c40e454e49eec834843ab03643d96 < 7b16eb911091aae237a8673da94e4dfb9cd21d54","Linux 4.19"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T10:35:18.850Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99167","references":[{"url":"https://git.kernel.org/stable/c/2465d27ef90de9105c2bffb6c35f8ce08918e642"},{"url":"https://git.kernel.org/stable/c/2e012e431aa271ef3c84206f48854f539c03bff0"},{"url":"https://git.kernel.org/stable/c/7b16eb911091aae237a8673da94e4dfb9cd21d54"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T11:09:40.389Z","slug":"CVE-2026-99167","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free the action between these operations,\ncausing the binding-count update to access freed memory. KASAN reports it\nas:\n\n  BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340\n  Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64\n\nHold the action IDR mutex across both counter updates and IDR removal,\nkeeping cleanup outside the lock.\n\n## Affected\n\n- `Linux >= 16af6067392c40e454e49eec834843ab03643d96 < 2465d27ef90de9105c2bffb6c35f8ce08918e642`\n- `Linux >= 16af6067392c40e454e49eec834843ab03643d96 < 2e012e431aa271ef3c84206f48854f539c03bff0`\n- `Linux >= 16af6067392c40e454e49eec834843ab03643d96 < 7b16eb911091aae237a8673da94e4dfb9cd21d54`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}