Linux Kernel CVE-2026-72338

Exploitation requires a local attacker or process holding the CAP_NET_ADMIN Linux capability. This capability is necessary to interact with the TC (traffic control) subsystem - specifically to create or modify cls_flower classifier entries and act_pedit actions targeting TC hardware offload. The race is reached when concurrent RTM_NEWACTION and fl_change() calls operate across their independent locking domains (RTNL vs. no RTNL). Hardware offload must be active or the offload code path must be reachable; systems without hardware-offload-capable NICs or where TC offload is explicitly disabled may not reach the vulnerable function. CAP_NET_ADMIN granted within a user namespace (as is common in rootless container runtimes) may be sufficient to reach the vulnerable path depending on kernel configuration. Exploitation is limited to local vectors - remote unauthenticated access is not possible. The CVSS vector (PR:L) reflects that the capability, while elevated, is routinely assigned in container and cloud-native environments.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the full kernel-level impact but the AC:L rating warrants scrutiny - TOCTOU race conditions inherently require timing precision, and independent assessment places this at AC:H, reducing the practical base score to approximately 7.0. The PR:L rating is appropriate given that CAP_NET_ADMIN is an elevated but sub-root capability frequently delegated in container runtimes and Kubernetes environments. EPSS at 0.21% (11th percentile) indicates no observed widespread exploitation at this time, yet even a mid-sized municipal IT team in opole should treat this as urgent on any multi-tenant container host where CAP_NET_ADMIN is routinely assigned to pod network namespaces. The Trend Micro ZDI report and the explicit poc-toctou process name in the KASAN trace confirm that a working research-grade POC exists, though its public availability is not confirmed; this is a POC-in-researcher-hands signal, not a confirmed-actively-exploited signal. The absence from CISA KEV is noted but may simply reflect the recency of the disclosure. The primary limiting factor is the CAP_NET_ADMIN requirement, which meaningfully narrows the attacker population on well-hardened single-tenant systems while remaining broadly reachable on container platforms.

A process inside a Kubernetes pod or rootless container granted CAP_NET_ADMIN concurrently issues RTM_NEWACTION (adding a pedit action with many keys) and manipulates cls_flower classifier rules, racing the TOCTOU window between buffer-size calculation and the fill phase in tcf_pedit_offload_act_setup(). The race causes a 4-byte attacker-influenced write at the boundary of a kmalloc-512 slab object, corrupting adjacent kernel metadata; from there the attacker leverages standard kernel heap exploitation techniques to escalate to ring-0 code execution. A Trend Micro ZDI POC named poc-toctou reliably triggered the KASAN trace and is confirmed in researcher possession.