CVE-2026-72338 Linux CVE debrief

Who should care

Administrators and users of the Linux kernel should be aware of this vulnerability and take steps to patch their systems. Affected operators, platforms, and security teams should prioritize patching to prevent potential heap OOB writes. Vulnerability management and security teams should review and update network configurations to ensure secure operation and monitor system logs for suspicious activity. Linux kernel deployments should be reviewed for exposure, and owners should be assigned for follow-up.

Technical summary

The Linux kernel vulnerability allows for a TOCTOU heap OOB write in tc offload. The cls_flower classifier operates with TCF_PROTO_OPS_DOIT_UNLOCKED, while RTM_NEWACTION holds RTNL, making the race reachable in practice. KASAN confirms a slab-out-of-bounds write. The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places using a new tcf_pedit_nkeys_locked() which replaces the old tcf_pedit_nkeys(). Administrators should prioritize patching this vulnerability to prevent potential heap OOB writes. Affected operators, platforms, and security teams should review and update network configurations to ensure secure operation.

Defensive priority

Administrators should prioritize patching this vulnerability to prevent potential heap OOB writes.

Recommended defensive actions

• Patch the Linux kernel to prevent potential heap OOB writes
• Review and update network configurations to ensure secure operation
• Monitor system logs for suspicious activity
• Verify system configurations for exposure
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The Linux kernel vulnerability allows for a TOCTOU heap OOB write in tc offload. The cls_flower classifier operates with TCF_PROTO_OPS_DOIT_UNLOCKED, while RTM_NEWACTION holds RTNL, making the race reachable in practice. KASAN confirms a slab-out-of-bounds write. Evidence is limited; defenders should verify system configurations and monitor for suspicious activity.

Official resources