CVE-2026-68138

net/sched: serialize qdisc_rtab_list against concurrent get/put

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC to CVE-2026-68138.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

Affected products and versions

2
ProductSourceVersion range

Linux

Browse Linux / Linux

Default status: unaffected, affected

CVE List470502de5bdb1ed0def643a4458593a40b8f6b66 to < fb29e1b41052488ee3f2d115d4a870497ebd7f7daffected
470502de5bdb1ed0def643a4458593a40b8f6b66 to < f43ee0c0730d6191629b5ee1ceae27b1ebfdc047affected
5.1affected
Before 5.1unaffected
7.1.6 to ≤ 7.1.*unaffected
7.2-rc5 to ≤ *unaffected

Kernel

Browse Linux / Kernel
OSV5.1.0 to < 7.1.6 · Fixed in 7.1.6affected

Proofs of concept

1

Repository PoCs

GitHubaramosf/CVE-2026-68138Repository PoCby aramosf6Exploit20 files

2.5 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a local privilege escalation exploit for CVE-2026-68138, a race condition in the Linux kernel's qdisc rate-table code. It uses a multi-stage technique involving a qdisc race, classic BPF heap spray, pipe leak, and page-cache overwrite to execute code as root in the initial user namespace.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two C source files implementing a local privilege escalation exploit for CVE-2026-68138. The code performs kernel heap manipulation, race condition triggering, and overwrites /sbin/modprobe to gain root. All behavior is consistent with the stated exploit goal and no concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesCAssembly
Target softwareLinux Kernel
Attack typesLocal Privilege EscalationUse-After-FreeRace Condition
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, compilable C source code that implements a multi-stage local privilege escalation attack. The code actively triggers a kernel race condition, performs heap manipulation, leaks kernel pointers, overwrites kernel memory, and executes a root shell. This is the definition of an exploit.

exploit.c:1-959README.md:5-8

Requirements

  • Unprivileged user namespaces and network namespaces enabled (CONFIG_USER_NS=y, CONFIG_NET_NS=y)README.md:100
  • Specific kernel configuration options enabled (CONFIG_NET_CLS, CONFIG_NET_CLS_FLOWER, CONFIG_NET_CLS_ACT, CONFIG_NET_ACT_POLICE, CONFIG_TMPFS_XATTR, CONFIG_MODULES)README.md:102-106
  • Memory cgroup accounting disabled (CONFIG_MEMCG=n) for the main PoCREADME.md:107-108
  • Per-process file-descriptor limit of at least 4096README.md:109
  • Disposable VM with approximately 5 GiB of RAMREADME.md:110

Observed behavior

  • Triggers a race condition on the global qdisc_rtab_list by sending concurrent RTM_NEWTFILTER netlink requests from multiple threads in separate network namespaces.exploit.c:429-507
  • Sprays the kmalloc-2k cache with classic BPF filter programs to reclaim a freed qdisc_rate_table object, creating an aliased memory region.exploit.c:509-527
  • Uses SO_GET_FILTER to detect the alias and then closes one socket to free the buffer, reclaiming it with pipe rings to leak kernel pointers (page and ops).exploit.c:632-650
  • Closes the second socket and reclaims the pipe ring with simple_xattr objects, forging a pipe_buffer with PIPE_BUF_FLAG_CAN_MERGE set.exploit.c:664-690
  • Writes attacker-controlled shellcode to the page-cache page of /sbin/modprobe via the dangling pipe write.exploit.c:692-719
  • Triggers execution of the overwritten /sbin/modprobe as root in the initial namespace by creating a socket with an unsupported protocol, which causes the kernel to request the missing module.exploit.c:721-758
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Overwrites /sbin/modprobe page-cache entry with attacker-controlled shellcode to execute a root shell.This is the documented exploitation technique for CVE-2026-68138 and is not a backdoor.exploit.c:692-719exploit.c:105-134
Exploit Behavior
Uses netlink sockets to trigger a race condition in the kernel's qdisc rate-table code.This is the documented vulnerability trigger and is not a backdoor.exploit.c:429-507
Exploit Behavior
Uses BPF filters and pipe/xattr sprays to reclaim freed kernel memory and leak pointers.These are standard kernel exploitation primitives and are not a backdoor.exploit.c:509-527exploit.c:596-650
Review boundaries

What the analysis did not establish

  • The evidence packet includes only three text files (README.md, exploit.c, ubuntu/exploit-5.15.0-187.c) out of 20 total files in the repository. The remaining 17 files, including build scripts, configuration fragments, and documentation, are not provided.
  • The analysis is based solely on static source code review. The code was not executed, and its effectiveness or reliability cannot be confirmed from the evidence alone.
  • The exploit targets a specific kernel version and configuration. Its behavior on other systems is not represented in the evidence.
  • 17 files in the repository were not provided as text and were not reviewed. The inventory indicates 1 non-text media file (likely the GIF screenshot) and 16 unclassified files. Their content is unknown.
  • The review is based solely on the supplied source code and README; no binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5