CVE-2026-53264 describes a race condition in the Linux kernel's net/sched subsystem where concurrent execution of NEWTFILTER and DELFILTER commands can cause a use-after-free (UAF) vulnerability. The root cause is that an action object is freed immediately after removal from an IDR (ID Radix Tree) without deferring the free operation, allowing another CPU to access freed memory. The patch reintroduces RCU-based deferred freeing using call_rcu() and kfree_rcu(), ensuring that the action object is only freed after a grace period, preventing UAF. This fix reverts a previous commit that removed RCU usage and modernizes the code to use kfree_rcu() directly.

The vulnerability allows a use-after-free condition in the kernel, which can lead to memory corruption with potential consequences including privilege escalation, denial of service, or arbitrary code execution within the kernel context. The CVSS vector indicates local attack vector with low complexity, requiring low privileges but no user interaction, and results in high confidentiality, integrity, and availability impact.

A fix for this vulnerability has been implemented in the Linux kernel by restoring RCU-based deferred freeing for the affected action lifecycle. Users should apply the official kernel updates that include this patch. Since no explicit patch links or vendor advisories are provided, verify with your Linux distribution vendor for updated kernel versions containing this fix. Patch status is not yet confirmed from vendor advisory; check vendor sources for current remediation guidance.