CVE-2026-68138

CVE-2026-68138 is a race condition in the kernel's qdisc rate-table subsystem (qdisc_rtab_list) that manifests as heap corruption with system-wide impact. The vulnerability was not introduced by new buggy code—it was exposed when cls_flower was optimized with TCF_PROTO_OPS_DOIT_UNLOCKED to reduce RTNL contention. That optimization removed an implicit serialization contract that the rate-table code had relied on for years without any explicit lock or documentation. The rate-table code manipulated qdisc_rtab_list without its own synchronization because every caller historically held RTNL. The cls_flower optimization broke that assumption without touching the rate-table code at all—only by calling through a path that no longer acquired RTNL. The result is a classic invariant collapse: code that was accidentally safe became genuinely unsafe through a change that looked unrelated. The fix (adding a dedicated spinlock) is straightforward, but the lesson extends beyond this specific bug. The blast radius is amplified by qdisc_rtab_list being global rather than per-network-namespace. A race triggered from an unprivileged container can corrupt a system-wide shared object, affecting all network namespaces simultaneously. This is not a container escape, but it is a path from less privileged network operations to kernel heap corruption with cross-namespace impact—a meaningfully different threat model than typical netns-local races. For defenders: check that your kernels include the spinlock fix for qdisc_rtab_list (the commit adds qdisc_rtab_lock). More importantly, audit other net/sched code paths that manipulate global objects without explicit locks and which historically relied on RTNL serialization. The pattern here—code that worked because callers happened to hold a lock rather than because it was designed to be thread-safe—is likely present elsewhere in the networking stack. Prioritize global objects that are accessed from multiple call contexts, especially those involved in ongoing performance optimizations that may remove RTNL dependencies.

Reviewed through automated stages and approved by a human before publication.