CVE-2026-23245 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators running systems that use traffic control features, especially act_gate, on kernels within the affected NVD version ranges. Because the CVSS vector includes PR:L, local users or processes with some level of access are the main concern.

Technical summary

NVD rates the issue 7.8 High with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerable condition is a race in act_gate: the action can be replaced while other kernel paths are iterating the schedule list. According to the kernel fix summary, the solution is to treat the parameters as an RCU-protected snapshot, perform replacement under tcf_lock, and defer freeing the old snapshot with call_rcu(). The description also notes that when REPLACE omits the entry list, the existing schedule is preserved so the effective state does not change. NVD maps affected Linux kernel ranges including 5.8.1 before 5.10.253, 5.11 before 6.1.167, 6.2 before 6.6.130, 6.7 before 6.12.78, 6.13 before 6.18.18, 6.19 before 6.19.8, plus 5.8, 7.0-rc1, and 7.0-rc2.

Defensive priority

High. This is a kernel-level concurrency flaw with high confidentiality, integrity, and availability impact in NVD’s assessment, so patching should be prioritized for any exposed or multi-user system running the affected code path.

Recommended defensive actions

• Confirm deployed kernel builds against the NVD affected version ranges and vendor backport status.
• Apply the kernel update or vendor backport that includes the RCU snapshot fix for act_gate.
• Prioritize remediation on systems that use traffic control scheduling features or allow local users to interact with the kernel.
• Coordinate maintenance windows for fleet updates, since this is a kernel change rather than a user-space mitigation.
• Track downstream distro advisories that reference the listed kernel patch commits for backported fixes.

Evidence notes

All statements are derived from the supplied CVE/NVD corpus and the referenced kernel patch records. The record identifies the flaw as a Linux kernel act_gate concurrency issue resolved by RCU snapshotting and call_rcu()-based cleanup. NVD marks the vulnerability as analyzed, assigns CVSS 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and lists vulnerable Linux kernel version ranges. Weakness classification in the record is NVD-CWE-noinfo.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.