SB2026081632 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72338)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform an out-of-bounds heap write.

The vulnerability exists due to a time-of-check time-of-use race condition leading to an out-of-bounds write in the act_pedit tc offload handling when sizing and filling a flow_rule buffer during cls_flower offload processing. A local privileged user can trigger concurrent action and classifier operations to perform an out-of-bounds heap write.

The written data is attacker-controlled and can corrupt an adjacent slab object.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0d8532a5e972a5351cf4ee4a435e0d65cbba8f23
• https://git.kernel.org/stable/c/27488e1a7f19757e6146edca9458ed4ffc545557
• https://git.kernel.org/stable/c/6f9b23eb92a894ae1118893996943990ee0b860e
• https://git.kernel.org/stable/c/8b519cbcabe836a441369fbec1a8a6518a709251
• https://git.kernel.org/stable/c/8e49cd891bda447c68122d672510a604a8bb6b24