CyberSecBulletin
CVE-2026-68138NVD status: Received

Linux: Concurrent Execution using Shared Resource with Improper Synchronization

Published Updated By the CyberSecBulletin desk

CVE-2026-68138 is a high-severity concurrent execution using shared resource with improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 1b050d09dd1a0ddae83bf012cf4956b7a960235f, 6e0241f6cbb149d926ee8efee2c734fea71452cf, f93c89392bd3b180b5b7abc6fdae8e3dd667a313 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.22% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 1b050d09dd1a0ddae83bf012cf4956b7a960235f or 6e0241f6cbb149d926ee8efee2c734fea71452cf or f93c89392bd3b180b5b7abc6fdae8e3dd667a313 or 4131dd0b6f67acddd616ed7c244e1d3eedd46e7b, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, 1b050d09dd1a0ddae83bf012cf4956b7a960235f; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, 6e0241f6cbb149d926ee8efee2c734fea71452cf; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, f93c89392bd3b180b5b7abc6fdae8e3dd667a313; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, 4131dd0b6f67acddd616ed7c244e1d3eedd46e7b; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, d981098b76756ed71666a27518eeb69883657c43; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, 8ddc2eb0d2da9c83f54f1e5720525b461b8480c4; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, fb29e1b41052488ee3f2d115d4a870497ebd7f7d; 470502de5bdb1ed0def643a4458593a40b8f6b66 up to, but not including, f43ee0c0730d6191629b5ee1ceae27b1ebfdc047; and 1 more ranges1b050d09dd1a0ddae83bf012cf4956b7a960235f, 6e0241f6cbb149d926ee8efee2c734fea71452cf, f93c89392bd3b180b5b7abc6fdae8e3dd667a313, 4131dd0b6f67acddd616ed7c244e1d3eedd46e7b, d981098b76756ed71666a27518eeb69883657c43, 8ddc2eb0d2da9c83f54f1e5720525b461b8480c4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Concurrent Execution using Shared Resource with Improper Synchronization

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How developers prevent this class of flaw

  • In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
  • Use thread-safe capabilities such as the data access abstraction in Spring.
  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

More Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities (CWE-362)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities

Spotted an error? Tell us.