A critical use-after-free vulnerability lurking in the Linux kernel’s traffic-control subsystem received a CVSS 3.1 score of 9.8, the highest severity rating, after being disclosed on July 26, 2026. Tracked as CVE-2026-64530, the flaw affects systems that use the Random Early Detection (RED) queueing discipline together with qevents and connection tracking (action ct) on fragmented network traffic. If exploited, an attacker could trigger memory corruption, potentially leading to remote code execution, system compromise, or denial of service. The patch is small—just a few lines in net/sched/clsapi.c—but the risk is outsized for internet-facing routers, virtual appliances, and any Linux host running advanced traffic-control configurations. Admins need to verify their systems and apply updates immediately.

What Went Wrong in the Traffic-Control Path

At the center of CVE-2026-64530 is a classic kernel ownership mistake involving network packet buffers (skbuff structures, or SKBs). When a packet arrives and Linux’s traffic-control classifier decides what to do with it, one possible return code is TCACTCONSUMED. This signal means the packet has been taken over by another subsystem—in this case, the connection-tracking defragmentation engine—and the original caller must no longer touch it. The problem was that the function tcfqeventhandle(), which processes qevent callbacks from queueing disciplines, never checked for this return code. It simply fell through a switch statement, treating the packet as if classification had completed normally, and handed it back to the calling qdisc.

The only qdisc that currently wires up qevents is RED. In the detailed upstream commit, maintainers confirmed that RED’s redenqueue() would continue operating on a packet it no longer owned: enqueueing it, dropping it, or updating statistics after the defragmentation engine had already claimed it. That mismatch creates a use-after-free condition—one of the most dangerous memory-safety bugs because it allows an attacker to manipulate freed memory to execute arbitrary code or crash the system. According to the NVD description, the vulnerable sequence can be triggered by attaching a qevent block to RED with a filter that invokes action ct, then sending fragmented UDP streams that cause out-of-order fragments and force defragmentation.

The patch, authored by Jamal Hadi Salim and accepted into the networking tree, adds a dedicated TCACTCONSUMED case inside tcfqeventhandle(). It marks the packet as stolen (NETXMITSTOLEN) and returns NULL, informing the caller that it can no longer use that SKB. The fix also explicitly avoids freeing the packet because ownership has already moved to the defragmentation engine—distinguishing this state from TCACTSTOLEN, where the caller would normally release the buffer.

Affected kernel versions span several stable trees. According to the NVD record, the vulnerability was introduced in specific git commits and propagated through stable releases. The table below summarizes the version ranges requiring patching, as documented by kernel.org:

Branch Affected versions Fixed in version
5.15 5.15.148 – 5.15.211 5.15.212
6.1 6.1.75 – 6.1.177 6.1.178
6.6 6.6.14 – 6.6.144 6.6.145
6.7+ 6.7.2 – 6.7. 6.8 (first unaffected)

Enterprise distributions often backport security fixes without changing the kernel version to the upstream fix number. For example, Fedora 44’s kernel 7.1.4-3 changelog, published July 22, 2026, documents the inclusion of this patch. Administrators running distribution-maintained kernels should check their vendor’s security advisories rather than relying solely on uname output.

What This Means for You

If You Manage Linux Routers, Gateways, or Virtual Appliances

These systems are at the highest risk because they are most likely to combine the ingredients that make CVE-2026-64530 exploitable. RED is a widely used congestion-management qdisc that helps prevent tail-drop delays in high-throughput environments. Any device configured with RED and qevents—particularly those using earlydrop or mark events tied to a filter block with action ct—should be treated as actively vulnerable. This includes:

  • Campus or data-center routers that use advanced QoS policies with traffic classification and connection tracking.
  • Virtual network-function hosts (Open vSwitch, DPDK-based appliances, cloud gateways) where users or scripts may have applied custom tc rules.
  • Kubernetes worker nodes that rely on tc-based network policies for pod egress shaping or service mesh telemetry, especially when CNI plugins insert ct actions.
  • Linux-based firewalls that perform stateful inspection or NAT while also applying queue management.

A remote attacker who can send carefully crafted fragmented packets to such a system could achieve code execution with kernel privileges, bypassing all security boundaries. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects exactly that worst-case scenario: network reachable, low complexity, no authentication or user interaction, and complete compromise of confidentiality, integrity, and availability.

If You Run Linux Desktops or Standard Servers

Most general-purpose Linux installations do not meet the exact configuration prerequisites. A default desktop or a typical web server using fqcodel or cake for congestion control is not affected. Risk becomes significant only when an administrator has explicitly configured RED with qevents and tc filter blocks using connection tracking. To be clear, simply having the tc tool installed or using basic traffic shaping does not make a machine vulnerable. The dangerous combination is:

  • A RED qdisc on an interface,
  • A qevent (earlydrop or mark) that references a tc block,
  • That block containing a filter with action ct,
  • Connection-tracking defragmentation enabled (default for ct action),
  • And the device receiving out-of-order fragments from a network.

If you’re unsure, the verification steps below will tell you whether your system is exposed.

If You Use Windows with WSL or Mixed Environments

This is not a Windows kernel vulnerability. The bug resides entirely in the Linux kernel. However, many Windows users run Linux virtual machines, WSL2 instances, or connect to corporate networks where Linux appliances sit in the traffic path. WSL2 uses a real Linux kernel, so if you have manually configured tc rules inside a WSL distribution (uncommon but possible), that environment could be vulnerable. More importantly, Windows endpoints may be protected or served by Linux routers or firewalls that need patching. Security-conscious enterprise admins should ensure that any Linux-based network infrastructure—regardless of the clients behind it—is updated.

The Road to Discovery: Fragile Packet Ownership

The flaw’s roots go back years. The TCACTCONSUMED return code has been part of the tc classifier API for a long time, but the codepath that connects RED’s qevents to connection tracking was introduced piecemeal. The upstream commit that introduced the initial actct regression (which created the possibility of the ct action holding packets) is noted in the patch’s commit message. Jamal Hadi Salim, a veteran Linux networking maintainer, identified the missing TCACTCONSUMED handler while investigating a bug report from the Zero Day Initiative (ZDI).

The patch was submitted in June 2026 and merged into the net tree, then backported to the affected stable kernels. Kernel.org published its advisory and CVSS score on July 26, 2026, and NVD followed a day later. At the time of writing, no public exploit code has been observed in the wild, but the combination of a 9.8 score and a relatively short proof-of-concept chain (as shown in the NVD description) means that in-the-wild exploitation is only a matter of time. Security researchers often develop working exploits from such clear root-cause analyses.

What to Do Now: Patch, Verify, and Mitigate

Step 1: Check Your Kernel Version

Run uname -r and compare the output against the version ranges in the table above. Remember that enterprise distributions may backport fixes; for example, a RHEL 9 kernel might show version 5.14.0-425.el9 but already include the fix. Consult your distribution’s security advisory or changelog.

On Fedora, you can check:

rpm -q --changelog kernel | grep CVE-2026-64530

On Debian/Ubuntu:

apt changelog linux-image-$(uname -r) | grep CVE-2026-64530

If your vendor has not released an update, you can verify the patch directly by checking for the presence of the TCACTCONSUMED case in the kernel source. The function tcfqeventhandle() in net/sched/clsapi.c should contain:

case TCACTCONSUMED:
    ret = _NETXMITSTOLEN;
    return NULL;

Step 2: Inspect Your Traffic Control Configuration

Even with a vulnerable kernel, exploitation requires the specific setup. Use these commands to audit your system:

# Show all qdiscs
tc qdisc show

For each interface with RED, show details

for dev in $(ip -br link | awk '!/lo/{print $1}'); do tc -s qdisc show dev $dev | grep -A5 red done

Look for qevent attachments

for dev in $(ip -br link | awk '!/lo/{print $1}'); do tc -s qdisc show dev $dev | grep 'qevent' done

If you see output containing qevent earlydrop block <N> or qevent mark block <N>, note the block number.

Next, examine filters on that block:

tc filter show block 10   # Replace 10 with your block number

Check for any filter that includes action ct. If present, your system is vulnerable.

Step 3: Apply Vendor Kernel Updates Immediately

For production systems, the surest remediation is to install the latest kernel update from your OS vendor and reboot. The following vendor references are known to carry the fix:

  • Fedora: kernel-7.1.4-3 or later (changelog entry dated July 22, 2026)
  • Upstream stable: 5.15.212, 6.1.178, 6.6.145, and 6.8 onward
  • Other distributions: Check your vendor’s security portal. Most enterprise distributions (Red Hat, SUSE, Ubuntu, Debian) will release advisories with backport information.

After updating, confirm with uname -r that the new kernel is active, and verify the tc configuration no longer matches the vulnerable pattern.

Step 4: Short-Term Mitigations If Patching Is Delayed

If an immediate reboot is impossible, reduce exposure by altering the traffic-control setup:

  1. Remove the qevent attachment from RED without changing the qdisc itself:
    bash tc qdisc change dev eth0 root red ... # reconfigure without qevent
    This preserves congestion-management behavior but disables the vulnerable callback path.

  2. Detach the dangerous filter:
    bash tc filter del dev eth0 block 10 prio <N> handle 800::800 u32
    (Adjust according to your filter’s details)

  3. Replace RED with an alternative qdisc like fqcodel or cake if your workload permits.

  4. Block fragmented traffic at a perimeter firewall before it reaches the vulnerable host, using iptables/nftables rules to drop fragments.

These measures are temporary stopgaps. They will alter network behaviour, potentially increasing latency or breaking legitimate fragmented connections. Validate them in a test environment first.

Outlook: What to Watch Next

CVE-2026-64530 is unlikely to be the last kernel vulnerability involving packet ownership across complex tc actions. The Linux networking stack’s flexibility—allowing chained classifiers, actions, and queueing disciplines—creates many handoff points where similar TCACTCONSUMED or TCACT_STOLEN bugs could lurk. Security researchers and kernel maintainers will likely audit other action–qdisc pairings more aggressively now that this pattern is well-understood.

For administrators, the lesson is clear: advanced traffic-control configurations deserve the same security scrutiny as firewall rules or exposed services. In the coming weeks, expect proof-of-concept exploits to surface, and treat any unpatched RED+qevent+ct setups as high-priority targets. Patch today, not tomorrow.