Strix
73.2K

CVE-2026-99167

HIGHCVSS 7.8/10EPSS 0.17%

Last modified

CVE-2026-99167 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.17%

6.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 16af6067392c40e454e49eec834843ab03643d96, < 4d83a3fc03bc595dd39b79ad61288738fbb1f2ba; >= 16af6067392c40e454e49eec834843ab03643d96, < fd01abed2568209f7daaf60e5ee68ae4a4744f48; >= 16af6067392c40e454e49eec834843ab03643d96, < fcc7d734ceccfab8ec3398c5b34f8e775d459507; >= 16af6067392c40e454e49eec834843ab03643d96, < fde33eb9955d819af282d5f5e84684eaec248291; >= 16af6067392c40e454e49eec834843ab03643d96, < 969ad6f2b266f383b44194d50d15631969b26222; >= 16af6067392c40e454e49eec834843ab03643d96, < 2465d27ef90de9105c2bffb6c35f8ce08918e642; >= 16af6067392c40e454e49eec834843ab03643d96, < 2e012e431aa271ef3c84206f48854f539c03bff0; >= 16af6067392c40e454e49eec834843ab03643d96, < 7b16eb911091aae237a8673da94e4dfb9cd21d54
LinuxLinux4.19

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99167?
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.
How severe is CVE-2026-99167?
CVE-2026-99167 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99167?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99167?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST