CVE-2026-99167 net/sched: fix use-after-free in __tcf_action_put()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99167?
CVE-2026-99167 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix use-after-free in __tcf_action_put()
__tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as:
BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64
Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
Which versions are affected by CVE-2026-99167?
How do I fix CVE-2026-99167?
Upgrade to a fixed version.
Is CVE-2026-99167 being exploited?
There is no known exploitation of CVE-2026-99167 in the wild and no public exploit code.
Sources
Also known as AZL-111314, BELL-CVE-2026-99167, DEBIAN-CVE-2026-99167, GHSA-5mc4-5p5h-x8vj, UBUNTU-CVE-2026-99167.