CVE-2026-64530

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net/sched component where the tcf qevent handle() function fails to properly handle the TC ACT CONSUMED return value from tcf classify(). This occurs when a socket buffer (skb) is held by the defragmentation engine, such as during act ct operations on out-of-order fragments, meaning the caller no longer owns the skb. Because tcf qevent handle() does not account for this state, it returns the skb to the caller as if classification succeeded. Consequently, the red enqueue() function may continue to operate on the skb by enqueueing, dropping, or updating statistics, leading to a Use-After-Free (UAF) condition. A Use-After-Free is a memory corruption issue where an application continues to use a pointer after it has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.