CVE-2026-72338

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A TOCTOU (Time-of-Check to Time-of-Use) race condition exists in the flower lockless approach during the sizing and filling of a flow rule buffer. This occurs because the cls flower classifier operates with TCF PROTO OPS DOIT UNLOCKED while RTM NEWACTION holds RTNL, creating independent locking domains that make the race reachable. This can lead to a heap out-of-bounds (OOB) write, allowing an attacker with CAP NET ADMIN privileges to write controlled content into an adjacent slab object. The issue was identified in the tcf pedit offload act setup() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.