ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-23413, a use-after-free in the Linux kernel net scheduler clsact qdisc allowing local privilege escalation, CVSS 8.2.
ZDI advisory ZDI-26-694 describes a use-after-free vulnerability in the Linux kernel's net scheduler clsact qdisc component. Successful exploitation allows local attackers to escalate privileges on affected installations, and ZDI assigned a CVSS score of 8.2. The flaw is tracked as CVE-2026-23413. The advisory notes an attacker must first obtain the ability to execute high-privileged code on the target system to exploit the vulnerability.
- Use-after-free in Linux kernel net scheduler clsact qdisc component
- Tracked as CVE-2026-23413 with CVSS score 8.2
- Enables local privilege escalation on affected installations
- Exploitation requires prior ability to execute high-privileged code
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-23413 | Linux kernel: clsact | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.