Linux Kernel Vulnerability in TCP Module Affecting Network Traffic Management

CVE-2026-64530

What is CVE-2026-64530?

A vulnerability has been identified in the Linux kernel related to network traffic classification. Specifically, the function tcf_qevent_handle() does not correctly handle the TC_ACT_CONSUMED action, which can occur during the defragmentation of packets. When this situation arises, the socket buffer (skb) can inadvertently be returned to the caller, even though it is no longer owned by the system. This oversight may lead to undefined behavior due to attempts to manipulate an skb that the caller does not own, particularly affecting the RED queue discipline. Proper handling requires treating TC_ACT_CONSUMED as a stolen action, ensuring that the skb is not accessed or modified after it has been identified as such.

References