CVE-2026-99167

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-99167
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99167.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-99167
Downstream
Published
2026-10-28T10:35:18Z
Modified
2026-11-02T02:35:47Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
net/sched: fix use-after-free in __tcf_action_put()
Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in __tcf_action_put()

__tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as:

BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64

Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99167.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
16af6067392c40e454e49eec834843ab03643d96
Fixed
4d83a3fc03bc595dd39b79ad61288738fbb1f2ba
Fixed
fd01abed2568209f7daaf60e5ee68ae4a4744f48
Fixed
fcc7d734ceccfab8ec3398c5b34f8e775d459507
Fixed
fde33eb9955d819af282d5f5e84684eaec248291
Fixed
969ad6f2b266f383b44194d50d15631969b26222
Fixed
2465d27ef90de9105c2bffb6c35f8ce08918e642
Fixed
2e012e431aa271ef3c84206f48854f539c03bff0
Fixed
7b16eb911091aae237a8673da94e4dfb9cd21d54

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99167.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.19.0
Fixed
5.10.273
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.224
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.161
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.115
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.59
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.13

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99167.json"