CVE-2026-23270 (GCVE-0-2026-23270)
Vulnerability from cvelistv5
Published
2026-03-18 17:54
Modified
2026-10-19 18:35
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/
References
Impacted products
Vendor Product Version
Linux Linux Version: 172ba7d46c202e679f3ccb10264c67416aaeb1c4
Version: 0b5b831122fc3789fff75be433ba3e4dd7b779d4
Version: 73f7da5fd124f2cda9161e2e46114915e6e82e97
Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6
Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6
Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6
Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6
Version: f5346df0591d10bc948761ca854b1fae6d2ef441
Version: 5.15.148   ≤
Version: 6.1.75   ≤
Version: 6.6.14   ≤
Version: 6.7.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:13:25.416Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23270",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:07:05.717761Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:40.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc4e5bb529823a09f02dbe96169de679a9db26e0",
              "status": "affected",
              "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
              "versionType": "git"
            },
            {
              "lessThan": "fb3c380a54e33d1fd272cc342faa906d787d7ef1",
              "status": "affected",
              "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
              "versionType": "git"
            },
            {
              "lessThan": "5a110ddcc99bda77a28598b3555fe009eaab3828",
              "status": "affected",
              "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
              "versionType": "git"
            },
            {
              "lessThan": "524ce8b4ea8f64900b6c52b6a28df74f6bc0801e",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "9deda0fcda5c1f388c5e279541850b71a2ccfcf4",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "11cb63b0d1a0685e0831ae3c77223e002ef18189",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.130",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\nAs Paolo said earlier [1]:\n\n\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\nthe current skb being held by the defragmentation engine. As reported by\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\nlater on tries to tuch again such packet.\"\n\nact_ct was never meant to be used in the egress path, however some users\nare attaching it to egress today [2]. Attempting to reach a middle\nground, we noticed that, while most qdiscs are not handling\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\naddress the issue by only allowing act_ct to bind to clsact/ingress\nqdiscs and shared blocks. That way it\u0027s still possible to attach act_ct to\negress (albeit only with clsact).\n\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploiting this requires local access to configure tc qdiscs/filters via netlink (RTM_NEWTFILTER), which is a local operation requiring CAP_NET_ADMIN. The UaF is then triggered by sending packets through the misconfigured egress path.\nAC:L - The attacker fully controls the setup: creating the namespace, configuring the qdisc with act_ct, and sending fragmented packets to trigger defragmentation. The UaF is reliably triggered without needing to win any external race.\nPR:L - CAP_NET_ADMIN is required for tc filter creation, but this capability is obtainable by any unprivileged local user via user namespaces (unshare -Urn), making this reachable with low privileges.\nUI:N - No user interaction is needed. The attacker sets up the tc configuration and sends packets entirely on their own.\nS:U - This is a standard kernel memory corruption vulnerability. The impact stays within the kernel\u0027s security authority with no cross-boundary escape (no VM escape or sandbox escape).\nC:H - The use-after-free allows an attacker to control freed object contents via heap spraying, enabling arbitrary kernel memory reads and information disclosure.\nI:H - The use-after-free provides arbitrary write primitives through heap spraying of the freed skb, enabling code execution and full kernel compromise.\nA:H - The use-after-free causes kernel crashes (oops/panic) when the qdisc accesses the freed skb, as demonstrated in the original crash trace in the blamed commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:00.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828"
        },
        {
          "url": "https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e"
        },
        {
          "url": "https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189"
        }
      ],
      "title": "net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23270",
    "datePublished": "2026-03-18T17:54:43.803Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-10-19T18:35:40.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.7\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.7\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.7\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.7\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.7\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-457936.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-784472.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-10-15T01:13:25.416Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23270\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:07:05.717761Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:07:06.432Z\"}}], \"cna\": {\"title\": \"net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploiting this requires local access to configure tc qdiscs/filters via netlink (RTM_NEWTFILTER), which is a local operation requiring CAP_NET_ADMIN. The UaF is then triggered by sending packets through the misconfigured egress path.\\nAC:L - The attacker fully controls the setup: creating the namespace, configuring the qdisc with act_ct, and sending fragmented packets to trigger defragmentation. The UaF is reliably triggered without needing to win any external race.\\nPR:L - CAP_NET_ADMIN is required for tc filter creation, but this capability is obtainable by any unprivileged local user via user namespaces (unshare -Urn), making this reachable with low privileges.\\nUI:N - No user interaction is needed. The attacker sets up the tc configuration and sends packets entirely on their own.\\nS:U - This is a standard kernel memory corruption vulnerability. The impact stays within the kernel\u0027s security authority with no cross-boundary escape (no VM escape or sandbox escape).\\nC:H - The use-after-free allows an attacker to control freed object contents via heap spraying, enabling arbitrary kernel memory reads and information disclosure.\\nI:H - The use-after-free provides arbitrary write primitives through heap spraying of the freed skb, enabling code execution and full kernel compromise.\\nA:H - The use-after-free causes kernel crashes (oops/panic) when the qdisc accesses the freed skb, as demonstrated in the original crash trace in the blamed commit.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"172ba7d46c202e679f3ccb10264c67416aaeb1c4\", \"lessThan\": \"bc4e5bb529823a09f02dbe96169de679a9db26e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0b5b831122fc3789fff75be433ba3e4dd7b779d4\", \"lessThan\": \"fb3c380a54e33d1fd272cc342faa906d787d7ef1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f7da5fd124f2cda9161e2e46114915e6e82e97\", \"lessThan\": \"5a110ddcc99bda77a28598b3555fe009eaab3828\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f14b377d01d8357eba032b4cabc8c1149b458b6\", \"lessThan\": \"524ce8b4ea8f64900b6c52b6a28df74f6bc0801e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f14b377d01d8357eba032b4cabc8c1149b458b6\", \"lessThan\": \"380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f14b377d01d8357eba032b4cabc8c1149b458b6\", \"lessThan\": \"9deda0fcda5c1f388c5e279541850b71a2ccfcf4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f14b377d01d8357eba032b4cabc8c1149b458b6\", \"lessThan\": \"11cb63b0d1a0685e0831ae3c77223e002ef18189\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f5346df0591d10bc948761ca854b1fae6d2ef441\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.148\", \"lessThan\": \"5.15.203\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.75\", \"lessThan\": \"6.1.167\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.14\", \"lessThan\": \"6.6.130\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.7.2\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}], \"programFiles\": [\"include/net/act_api.h\", \"net/sched/act_ct.c\", \"net/sched/cls_api.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.203\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.130\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.77\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.19.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/act_api.h\", \"net/sched/act_ct.c\", \"net/sched/cls_api.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0\"}, {\"url\": \"https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1\"}, {\"url\": \"https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828\"}, {\"url\": \"https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e\"}, {\"url\": \"https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6\"}, {\"url\": \"https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4\"}, {\"url\": \"https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\\n\\nAs Paolo said earlier [1]:\\n\\n\\\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\\nthe current skb being held by the defragmentation engine. As reported by\\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\\nlater on tries to tuch again such packet.\\\"\\n\\nact_ct was never meant to be used in the egress path, however some users\\nare attaching it to egress today [2]. Attempting to reach a middle\\nground, we noticed that, while most qdiscs are not handling\\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\\naddress the issue by only allowing act_ct to bind to clsact/ingress\\nqdiscs and shared blocks. That way it\u0027s still possible to attach act_ct to\\negress (albeit only with clsact).\\n\\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.203\", \"versionStartIncluding\": \"5.15.148\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.167\", \"versionStartIncluding\": \"6.1.75\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.130\", \"versionStartIncluding\": \"6.6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.77\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.18\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19.8\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.7.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:21:00.613Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23270\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T18:35:40.580Z\", \"dateReserved\": \"2026-01-13T15:37:45.991Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-03-18T17:54:43.803Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.