Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify()… (CVE-2026-64530)
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop) red_enqueue() was continuing to operate on an skb it no longer owns in this case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF. tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10 tc filter add block 10 ... action ct (with ct defrag enabled and traffic that produces out-of-order fragments, e.g. a fragmented UDP stream) Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress and egress fast paths do: treat it as stolen and return NULL without touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be dropped/freed here, as it is no longer owned by us.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64530 involves the net/sched subsystem where the cls_api component's tcf_qevent_handle function fails to properly handle the TC_ACT_CONSUMED action. When this action occurs, the socket buffer (skb) is held by the defragmentation engine and is no longer owned by the caller, but tcf_qevent_handle incorrectly returns the skb as if classification succeeded. This leads to the RED queueing discipline continuing to operate on an skb it no longer owns, resulting in a use-after-free (UAF) condition. The vulnerability affects Linux kernel versions >=9.2 <9.3 and >=10.0 <10.1 as used in Red Hat Enterprise Linux 9.2 and 10.0 Extended Update Support. Red Hat has issued security advisories RHSA-2026:47620 and RHSA-2026:48222 with patches that fix this issue. The fix requires updating the kernel packages and rebooting the system.
Potential Impact
The vulnerability allows a use-after-free condition in the Linux kernel's network scheduler, which can lead to potential system crashes, memory corruption, or escalation of privileges due to improper handling of socket buffers. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability of affected systems. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released official security updates that fix this vulnerability. Users should apply the kernel updates provided in advisories RHSA-2026:47620 and RHSA-2026:48222 for Red Hat Enterprise Linux 10.0 Extended Update Support and 9.2 Update Services for SAP Solutions, respectively. After applying the updates, a system reboot is required for the fix to take effect. Red Hat recommends treating all kernel errata as security-relevant and applying updates promptly to maintain system security.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify()… (CVE-2026-64530)
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop) red_enqueue() was continuing to operate on an skb it no longer owns in this case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF. tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10 tc filter add block 10 ... action ct (with ct defrag enabled and traffic that produces out-of-order fragments, e.g. a fragmented UDP stream) Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress and egress fast paths do: treat it as stolen and return NULL without touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be dropped/freed here, as it is no longer owned by us.
CVSS v3.1
Score 9.8critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64530 involves the net/sched subsystem where the cls_api component's tcf_qevent_handle function fails to properly handle the TC_ACT_CONSUMED action. When this action occurs, the socket buffer (skb) is held by the defragmentation engine and is no longer owned by the caller, but tcf_qevent_handle incorrectly returns the skb as if classification succeeded. This leads to the RED queueing discipline continuing to operate on an skb it no longer owns, resulting in a use-after-free (UAF) condition. The vulnerability affects Linux kernel versions >=9.2 <9.3 and >=10.0 <10.1 as used in Red Hat Enterprise Linux 9.2 and 10.0 Extended Update Support. Red Hat has issued security advisories RHSA-2026:47620 and RHSA-2026:48222 with patches that fix this issue. The fix requires updating the kernel packages and rebooting the system.
Potential Impact
The vulnerability allows a use-after-free condition in the Linux kernel's network scheduler, which can lead to potential system crashes, memory corruption, or escalation of privileges due to improper handling of socket buffers. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability of affected systems. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released official security updates that fix this vulnerability. Users should apply the kernel updates provided in advisories RHSA-2026:47620 and RHSA-2026:48222 for Red Hat Enterprise Linux 10.0 Extended Update Support and 9.2 Update Services for SAP Solutions, respectively. After applying the updates, a system reboot is required for the fix to take effect. Red Hat recommends treating all kernel errata as security-relevant and applying updates promptly to maintain system security.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w5h3-gv63-49vp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64530"]
Threat ID: 6a668e919c2644c7f89387da
Added to database: 07/26/2026, 22:47:45 UTC
Last enriched: 08/15/2026, 02:13:44 UTC
Last updated: 09/10/2026, 19:36:55 UTC
Views: 337
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.