CVE-2026-23413 addresses a use-after-free vulnerability in the Linux kernel's clsact qdisc subsystem. The flaw arises from an asymmetry in the rollback process during initialization and destruction of clsact instances. Specifically, clsact_init() initializes ingress before egress, and if ingress initialization succeeds but egress initialization fails (e.g., via tcf_block_get_ext()), the rollback triggers clsact_destroy(). However, due to both ingress and egress entries being non-NULL during this failure state, clsact_destroy() improperly handles references, leading to use-after-free conditions. This vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related variants. The issue has been fixed in updated kernel releases. The vulnerability has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability. Ubuntu advisories USN-8567-1 and USN-8574-1 confirm the fix and recommend updating to patched kernel versions. No known exploits have been reported in the wild.

Successful exploitation of this use-after-free vulnerability could allow a local attacker with limited privileges to cause memory corruption, potentially leading to privilege escalation, system compromise, or denial of service. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

A patch addressing this vulnerability is available and has been released in updated Linux kernel versions. Users should apply the official kernel updates for their distributions, specifically versions 6.8.0-1064.72 and later, or the corresponding patched builds listed in the advisory. After updating, a system reboot is required to activate the fixes. Due to an ABI change in the kernel update, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor guidance for updating and rebuilding kernel modules as needed.