What happened
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
Affected versions
Kernel: 4.14.0 through before 4.14.322 (semver); 4.15.0 through before 4.19.291 (semver); 4.20.0 through before 5.4.248 (semver); 5.5.0 through before 5.10.185 (semver); 5.11.0 through before 5.15.118 (semver); 5.16.0 through before 6.1.35 (semver); 6.2.0 through before 6.3.9 (semver) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.