Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-46319— net/sched: act_ct: Only release RCU read lock after ct_ft

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于act_ct中tcf_ct_flow_table_get()函数在rhashtable_lookup_fast()内部释放RCU读锁后，返回的ct_ft对象可能已被释放，导致释放后重用，可能导致权限提升。

CVSS 7.8 · High EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a< ece578ca61e572df96cfc80456357ebfae0b4b9e affected
138470a9b2cc2e26e6018300394afc3858a54e6a< a2e0c045c87aa252eb61412e67dd91f2c2b19f81 affected
138470a9b2cc2e26e6018300394afc3858a54e6a< 67c9ecc9f2575273ed1323e312881fc98ac83d6d affected
138470a9b2cc2e26e6018300394afc3858a54e6a< f23424a0ddadb494d4bd57056a7ca703312d3a7b affected
138470a9b2cc2e26e6018300394afc3858a54e6a< 17dfb67cb399b660105d9a8c6100851c0d0cdc70 affected
138470a9b2cc2e26e6018300394afc3858a54e6a< 4c727c6967a41b37efe0f26332ca9ec5b74785a3 affected
138470a9b2cc2e26e6018300394afc3858a54e6a< 3e20e1b3058e0b94638e7b931c138e840e266724 affected
138470a9b2cc2e26e6018300394afc3858a54e6a< f462dca0c8415bf0058d0ffa476354c4476d0f09 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46319

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/sched: act_ct: Only release RCU read lock after ct_ft
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... } static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj; rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_read_unlock(); return obj; } At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft from zones_ht . The lookup is performed within an RCU read critical section through rcu_read_lock() / rcu_read_unlock(), which prevents the object from being freed. However, at the point of function return, rcu_read_unlock() has already been called, and there is nothing preventing ct_ft from being freed before reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes the race window, during which ct_ft can be freed. Free Process: tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu() tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put(). static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft) { if (refcount_dec_and_test(&ct_ft->ref)) { rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); // [3] queue_rcu_work(act_ct_wq, &ct_ft->rwork); } } At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) { struct tcf_ct_flow_table *ct_ft; struct flow_block *block; ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, rwork); nf_flow_table_free(&ct_ft->nf_ft); block = &ct_ft->nf_ft.flow_block; down_write(&ct_ft->nf_ft.flow_block_lock); WARN_ON(!list_empty(&block->cb_list)); up_write(&ct_ft->nf_ft.flow_block_lock); kfree(ct_ft); // [4] module_put(THIS_MODULE); } tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes between [1] and [2], UAF occurs. This race condition has a very short race window, making it generally difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was inserted after[1]
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于act_ct中tcf_ct_flow_table_get()函数在rhashtable_lookup_fast()内部释放RCU读锁后，返回的ct_ft对象可能已被释放，导致释放后重用，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 138470a9b2cc2e26e6018300394afc3858a54e6a ~ ece578ca61e572df96cfc80456357ebfae0b4b9e -
Linux Linux 5.7 -

II. Public POCs for CVE-2026-46319

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-46319

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46319 (8)

Same Patch Batch · Linux · 2026-06-09 · 21 CVEs total

CVE-2026-46325 9.8 CRITICAL RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
CVE-2026-46316 9.3 CRITICAL KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
CVE-2026-46317 8.8 HIGH KVM: arm64: Reassign nested_mmus array behind mmu_lock
CVE-2026-46326 8.4 HIGH iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
CVE-2026-46332 8.0 HIGH greybus: gb-beagleplay: bound bootloader receive buffering
CVE-2026-52907 7.8 HIGH media: rockchip: rkcif: fix off by one bugs
CVE-2026-46323 7.8 HIGH net: gro: don't merge zcopy skbs
CVE-2026-46330 7.8 HIGH Revert "net/smc: Introduce TCP ULP support"
CVE-2026-46324 7.8 HIGH netfilter: nf_tables: use list_del_rcu for netlink hooks
CVE-2026-46327 7.8 HIGH dm: fix unlocked test for dm_suspended_md
CVE-2026-52906 7.7 HIGH 9p: fix access mode flags being ORed instead of replaced
CVE-2026-46320 7.4 HIGH tap: free page on error paths in tap_get_user_xdp()
CVE-2026-46328 7.3 HIGH apparmor: fix rlimit for posix cpu timers
CVE-2026-46322 7.1 HIGH tun: free page on build_skb failure in tun_xdp_one()
CVE-2026-46321 7.1 HIGH tun: free page on short-frame rejection in tun_xdp_one()
CVE-2026-46329 erofs: handle end of filesystem properly for file-backed mounts
CVE-2026-46318 Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
CVE-2026-52904 drm/nouveau: fix nvkm_device leak on aperture removal failure
CVE-2026-52905 mm/damon/core: disallow non-power of two min_region_sz on damon_start()
CVE-2026-46315 io_uring/waitid: clear waitid info before copying it to userspace

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-46319

No comments yet

Leave a comment