CVE-2026-68138: Linux Kernel qdisc Rate‑Table Race Condition Allows Local Privilege Escalation (PoC Included)

Vulnerability Overview : CVE‑2026‑68138 is a race‑condition local‑privilege‑escalation bug in the Linux kernel’s traffic‑control subsystem, specifically in the qdisc rate‑table implementation. The flaw resides in qdisc_get_rtab() and qdisc_put_rtab(), which manage a global singly‑linked list qdisc_rtab_list and a non‑atomic reference counter refcnt. Historically callers held the RTNL mutex, serialising access, but the flower classifier can invoke these helpers without the lock via the TCF_PROTO_OPS_DOIT_UNLOCKED flag when handling RTM_NEWTFILTER requests.

Impacted Versions : The vulnerability was introduced in commit 470502de5bdb and is present in Linux kernels 5.1 through 7.1.5 (unless a vendor back‑port removes it). It was fixed in mainline 7.2‑rc5 (commit f43ee0c0730d) and in the stable 7.1.6 branch (commit fb29e1b41052). Ubuntu kernels 22.04 GA (5.15.0‑187.197), 22.04 HWE (6.8.0‑136.136), and 24.04/26.04 HWE (7.0.0‑28.28) contain the vulnerable code, though allocator hardening may block the exploit.

Exploitation Conditions : The PoC requires an x86‑64 Linux VM with at least four vCPUs, unprivileged user and network namespaces enabled ( CONFIG_USER_NS=y, CONFIG_NET_NS=y), the traffic‑control modules ( CONFIG_NET_CLS=y, CONFIG_NET_CLS_FLOWER=y, CONFIG_NET_CLS_ACT=y, CONFIG_NET_ACT_POLICE=y), classic BPF socket filters with JIT support, a writable tmpfs for XATTR‑based heap spraying, loadable kernel modules, ≥5 GiB RAM, and a file‑descriptor limit of at least 4096. Memory‑cgroup accounting kernels and Ubuntu 24.04/26.04 HWE with allocator hardening are not exploitable with the current PoC.

PoC Attack Flow :

Three worker threads follow the success path: they create a flower filter with a police action and obtain a reference to the rate‑table.

A fourth worker (worker 0) follows the error path by supplying an intentionally invalid estimator (e.g., .interval = 5, exceeding the maximum of 3), causing the helper to release both R‑tab and P‑tab.

The race is triggered: while the tables are freed but pointers remain, other workers’ BPF allocations can spray into the same memory slot.

Use‑After‑Free exploitation: SO_GET_FILTER checks whether the socket’s orig_prog‑>filter pointer has been redirected to a live BPF allocation.

Privilege escalation: the attacker closes an owner, delaying release via sk_filter_release_rcu(); after the grace period the PoC re‑claims the memory and gains root.

Key Code Snippet (illustrating the invalid estimator used to trigger the error path):

// Build filter request; deliberately provide an invalid estimator to hit the error path
if (slow_holder) {
    // interval=5 is invalid (max allowed is 3)
    struct tc_estimator estimator = {.interval = 5, .ewma_log = 1};
    addattr(nh, cap, TCA_RATE, &estimator, sizeof(estimator));
}

Core Data Structure leaked by the exploit:

struct leaked_pipe_buffer {
    uint64_t page;
    uint32_t offset;
    uint32_t len;
    uint64_t ops;
    uint32_t flags;
    uint32_t padding;
    uint64_t private;
};

Leaking a pipe buffer reveals kernel pointers ( page and ops) that bypass KASLR.

Mitigation :

Upstream patches add a qdisc_rtab_lock spin‑lock protecting accesses to qdisc_rtab_list and refcnt (mainline commit f43ee0c0730d, stable commit fb29e1b41052).

Temporary work‑arounds:

Disable unprivileged user namespaces: sysctl -w kernel.unprivileged_user_ns=0.

Disable network namespaces if not needed: clear CONFIG_NET_NS.

In container environments, drop the CAP_NET_ADMIN capability.

Detection & Response :

Indicators of compromise: kernel version 5.1‑7.1.5 (or corresponding Ubuntu releases) and frequent RTM_NEWTFILTER netlink messages; processes attempting to read /proc/self/ns/net.

Simple detection script:

# Check kernel version
uname -r

# Check if the fix is present
grep -q "qdisc_rtab_lock" /proc/kallsyms && echo "Patched" || echo "Possibly vulnerable"

Conclusion : CVE‑2026‑68138 highlights longstanding concurrency bugs in the Linux networking stack; despite a high exploitation barrier, successful exploitation grants full system privileges. Users running affected kernels should upgrade promptly or apply the listed mitigations.