VulnerabilityPublished 13 Aug 2026

ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 21 Aug 2026, 17:34 UTC

What to do

AI-suggested

Linux has issued an official update that corrects this vulnerability. Users and administrators should apply the Linux Kernel update containing the fix referenced in the vendor advisory (https://github.com/torvalds/linux/commit/8b519cbcabe836a441369fbec1a8a6518a709251) to remediate this issue.

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Impact

The vulnerability enables local attackers who already have high-privileged code execution on the system to escalate their privileges further and execute code within the kernel context. This can lead to full system compromise or bypass of security controls enforced by the kernel.

Summary

This vulnerability (ZDI-26-575) affects the Linux Kernel's traffic classifier component within the Net Scheduler Packet Classifier API. The root cause is a time-of-check to time-of-use (TOCTOU) race condition resulting from a lack of proper locking when performing operations on an object. An attacker with existing high-privileged code execution capabilities can exploit this flaw to escalate privileges further and execute code in kernel context. The vulnerability has been assigned a CVSS score of 7.5 by the Zero Day Initiative, indicating high severity. Linux has released a patch to fix this issue, available at the referenced GitHub commit.

References

zerodayinitiative.com/advisories/ZDI-26-575/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 13 Aug 2026, 20:47 UTC

References

Community reviews

Related threats