Technical Summary

CVE-2026-23245 is a vulnerability in the Linux kernel's net/sched act_gate component where the gate action parameters could be replaced while the hrtimer callback or dump path was walking the schedule list. This race condition could cause use-after-free or inconsistent state. The fix involves converting parameters to an RCU-protected snapshot, swapping updates under the tcf_lock, and freeing the previous snapshot via call_rcu(). The update is part of a broader Linux kernel security patch addressing multiple vulnerabilities across many subsystems and architectures. The vulnerability affects linux-hwe-edge kernel versions prior to several 6.8.x releases. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability with high severity. The vendor advisory confirms patches are available and a reboot is required after update.