CVE-2026-64530
CVE-2026-64530: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.8
High [CVE-2026-64530] Handle TC_ACT_CONSUMED in tcf_qevent_handle
CVE-2026-64530Source published Source updated
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop) red_enqueue() was continuing to operate on an skb it no longer owns in this case -- enqueueing it, dropping it, or updating statistics. Resulting in a…
- Affected products in this advisory
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
4 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- kernel-0:6.12.0-211.42.1.el10_2
- kpatch-patch
- kernel-0:6.12.0-55.93.1.el10_0
- kernel-rt-0:4.18.0-553.150.1.rt7.491.el8_10
20 more entries in the full advisory.
- Mitigation guidance
- To mitigate this issue, avoid configuring the Linux kernel's traffic control (tc) subsystem with the RED queue discipline (`red`) that includes `qevent early_drop` and an `action ct` filter on interfaces processing fragmented UDP streams. This specific configuration is required to trigger the use-after-free vulnerability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.