CVE-2026-64530 Linux CVE debrief

Who should care

Linux kernel users and administrators, network operators, and security teams should be aware of this vulnerability and take necessary actions to protect their systems. They should review and apply patches for the net/sched: cls_api vulnerability, monitor network traffic and system logs for suspicious activity, and implement compensating controls, such as network segmentation and access controls. The vulnerability affects Linux kernel deployments, and defenders should verify the affected scope and severity with the Linux kernel community and relevant vendors.

Technical summary

The tcf_qevent_handle function in the Linux kernel's net/sched: cls_api did not handle TC_ACT_CONSUMED correctly, leading to a use-after-free (UAF) vulnerability. When tcf_classify returns TC_ACT_CONSUMED, the skb is no longer owned by the caller and must not be touched again. The function should treat TC_ACT_CONSUMED as stolen and return NULL without touching the skb. This vulnerability affects the Linux kernel's net/sched: cls_api and has been addressed. However, defenders should review and apply patches for the net/sched: cls_api vulnerability and monitor network traffic and system logs for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Update the Linux kernel to the latest version
• Review and apply patches for the net/sched: cls_api vulnerability
• Monitor network traffic and system logs for suspicious activity
• Implement compensating controls, such as network segmentation and access controls
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-26T07:16:41.680Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about this vulnerability, and defenders should verify the affected scope and severity with the Linux kernel community and relevant vendors. The tcf_qevent_handle function in the Linux kernel's net/sched: cls_api did not handle TC_ACT_CONSUMED correctly, leading to a use-after-free (UAF) vulnerability. This issue occurs when the skb is held by the defragmentation engine and tcf_classify returns TC_ACT_CONSUMED. The function should treat TC_ACT_CONSUMED as stolen and return NULL without touching the skb.

Official resources