CVE-2026-46319 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers working with the Linux kernel should assess exposure and prioritize verification of Linux kernel versions, especially those related to act_ct and flow table management. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and monitor for suspicious activity related to act_ct.

Why it matters

A use-after-free vulnerability in the Linux kernel's act_ct component can lead to privilege escalation. Linux system administrators and security teams should assess exposure and prioritize verification of Linux kernel versions.

• Privilege escalation is possible due to the use-after-free vulnerability.
• Verification of Linux kernel versions and patches is necessary.
• Monitoring for suspicious activity related to act_ct is recommended.

Technical summary

The vulnerability exists in the act_ct component of the Linux kernel. A use-after-free occurs when tcf_ct_flow_table_cleanup_work() completes before refcount_inc_not_zero() is invoked on the returned ct_ft object. This can lead to privilege escalation. The vulnerability can be triggered when looking up a flow table in act_ct, rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object.

Defensive priority

Linux system administrators and security teams should assess exposure and prioritize verification of Linux kernel versions, especially those related to act_ct and flow table management.

Recommended defensive actions

• Review Linux kernel versions and patches to ensure act_ct is updated.
• Verify system configurations and flow table management.
• Monitor for suspicious activity related to act_ct.
• Perform a thorough review of the Linux kernel's act_ct component to identify potential vulnerabilities.
• Implement compensating controls to mitigate the vulnerability while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and Linux kernel source code indicate a use-after-free vulnerability in act_ct. Official references from the Linux kernel Git repository are provided. The vulnerability can be triggered when tcf_ct_flow_table_cleanup_work() completes before refcount_inc_not_zero() is invoked on the returned ct_ft object, resulting in a UAF on the already freed ct_ft object.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.