CVE-2026-68138

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the network scheduler when handling rate-table lookups, inserts, and frees. The functions qdisc get rtab() and qdisc put rtab() modify the process-global singly linked list qdisc rtab list and a non-atomic refcnt variable without proper locking. While previously protected by the RTNL mutex, certain operations in cls flower now allow these functions to be called without holding the mutex. Concurrent requests on different CPUs adding flower filters with the same rate can lead to a use-after-free or double-free of the qdisc rate table structure, which is shared system-wide.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.