Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local root

Impact

Use-after-free in the tcindex traffic-control filter - local root

Who can reach it

Any tenant process in a container with CAP_NET_ADMIN in a userns

What to do

Livepatchable; otherwise drain + reboot. Blacklist cls_tcindex

References

Related entries

• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm/vmx): With adaptive PEBS exposed, KVM never guaranteed that LBR MSRs held guest valuesCVE-2024-26992 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel (drivers/gpu/drm/nouveau): When the device-to-host copy behind a page fault silently fails, the faultCVE-2024-50096 · Linux kernel (drivers/gpu/drm/nouveau)High
• Linux kernel (uvcvideo): Out-of-bounds write parsing UVC_VS_UNDEFINED frames - exploited in the wildCVE-2024-53104 · Linux kernel (uvcvideo)High