ZDI-26-574: Linux Kernel Net Scheduler Connection Tracking Race Condition Local Privilege Escalation Vulnerability
A race condition (CVE-2026-46319, CVSS 7.5) in the Linux kernel net scheduler connection tracking allows local privilege escalation.
ZDI advisory ZDI-26-574 documents a race condition in the Linux kernel's net scheduler connection tracking component. Local attackers who can execute high-privileged code on a target can exploit the flaw to escalate privileges. ZDI rated the vulnerability 7.5 on CVSS and assigned CVE-2026-46319.
- Race condition in Linux kernel net scheduler connection tracking.
- Enables local privilege escalation after high-privileged code execution.
- CVSS 7.5; tracked as CVE-2026-46319 under ZDI-26-574.
- CVEs
- CVE-2026-46319
- Products
- Linux Kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-46319 | Linux kernel: net/sched: act_ct: Only release RCU read lock after ct_ft | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.