CVE-2026-99167

Last refreshed2026-10-31

Status: UPDATED | Advisory ID: CVE-2026-99167

Key Details

CVE	CVE-2026-99167
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-31
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in __tcf_action_put()

__tcf_action_put() decrements the reference count before decrementing the

binding count. Another thread can free the action between these operations,

causing the binding-count update to access freed memory. KASAN reports it

as:

BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340

Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64

Hold the action IDR mutex across both counter updates and IDR removal,

keeping cleanup outside the lock. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-99167
CVE	https://www.cve.org/CVERecord?id=CVE-2026-99167

Source

Reference

NVD

CVE