In the Linux kernel

CVE-2026-68138 is a race condition in the Linux kernel's traffic-control rate-table code (net/sched). The functions qdisc_get_rtab() and qdisc_put_rtab() manipulate a process-global singly linked list (qdisc_rtab_list) and a plain non-atomic int refcnt without any lock. This was historically safe because all callers held the RTNL mutex — but the flower classifier sets TCF_PROTO_OPS_DOIT_UNLOCKED, allowing tc_new_tfilter() to reach the police action path without RTNL. The resulting use-after-free is exploitable for local privilege escalation from UID 1000 to root in the initial user namespace. Affected kernels span Linux 5.1 through 7.1.5 — roughly seven years of mainline releases. The fix landed in 7.1.6 and 7.2-rc5.

The vendor’s HIGH / 7.8 rating is accurate for this bug. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures the local-only attack surface and complete CIA impact upon exploitation. There is a public, weaponized proof-of-concept by security researcher A. Ramos that reliably escalates to root in a QEMU environment. The wide affected-version range (5.1–7.1.5) means virtually every enterprise Linux fleet has vulnerable hosts right now. The only thing preventing a CRITICAL rating is the hard requirement for local code execution — an attacker must already be on the box.

Why this verdict

• Public weaponized PoC eliminates complexity discount. Despite being a race condition, the PoC by A. Ramos demonstrates reliable exploitation in a standard QEMU environment on a shipping Ubuntu kernel. AC:L is justified.
• Massive affected footprint. Kernels 5.1 through 7.1.5 cover roughly seven years of releases. In a 10,000-host fleet, expect 90%+ of Linux hosts to carry vulnerable kernels, making selective scoping impractical.
• Role multiplier: HIGH-value roles are directly impacted. The Linux kernel is the affected component itself. On Kubernetes nodes and container hosts (high-value role, >=10% of Linux installs in enterprise), this bug lets a container-escaped attacker (or a malicious co-tenant) escalate to host root — blast radius is node-level, potentially fleet-scale if the attacker pivots across nodes. On hypervisors (KVM hosts), exploitation yields hypervisor-root. On CI/CD runners (GitLab Runner, GitHub Actions self-hosted), a supply-chain actor with job execution gets host root. These roles floor the verdict at HIGH.
• Local-access prerequisite provides meaningful friction. AV:L means the attacker must already have a shell on the target host. This is a real barrier that prevents mass-exploitation at internet scale and is the primary reason the verdict stays HIGH rather than CRITICAL.
• No in-the-wild exploitation or KEV listing yet. The PoC is public but no campaigns have been observed. This removes urgency pressure that would push toward CRITICAL.

Why not higher?

The hard requirement for local code execution (AV:L) means this cannot be exploited remotely. An attacker must already have a foothold on the target host. While the role multiplier on container hosts and hypervisors is severe, the local-only vector means mass exploitation requires a separate initial-access vulnerability first. Without active KEV listing or observed campaigns, the urgency does not justify CRITICAL.

Why not lower?

A public, weaponized PoC that achieves reliable root from an unprivileged user on a shipping Ubuntu kernel eliminates any argument for MEDIUM. The affected version range spans seven years of kernels, meaning virtually every Linux host is in scope. On container hosts, Kubernetes nodes, and CI/CD runners, this LPE is the final link in a container-escape-to-fleet-compromise chain — the blast radius on high-value roles is too severe for anything below HIGH.

1. Disable unprivileged user namespaces — Set sysctl kernel.unprivileged_userns_clone=0 (or the equivalent kernel.apparmor_restrict_unprivileged_userns=1 on Ubuntu 24.04+). The PoC relies on creating network namespaces as an unprivileged user to reach the unlocked flower classifier path. This is the single highest-value mitigation. Deploy within 30 days per noisgate mitigation SLA.
2. Disable kernel module autoloading — Set sysctl kernel.modules_disabled=1 after boot completes and all required modules are loaded. This blocks the final exploitation step (modprobe_path hijack). Requires careful testing in your environment as late-loading modules will fail. Deploy within 30 days.
3. Unload or blacklist cls_flower if unused — Run modprobe -r cls_flower and add blacklist cls_flower to /etc/modprobe.d/. The vulnerable code path requires the flower classifier. If your traffic-control policies do not use flower, removing it eliminates the attack surface entirely.
4. Enable SELinux or AppArmor in enforcing mode — Mandatory access control policies can prevent the attacker’s replacement modprobe script from executing, even if the page-cache overwrite succeeds. Ensure the policy confines /sbin/modprobe execution tightly.
5. Deploy LKRG or IMA — Linux Kernel Runtime Guard detects credential structure modifications (UID changes from the exploit). Integrity Measurement Architecture can alert on unexpected modprobe_path content. These provide detection-in-depth.

Run this script on each target Linux host as any user with read access to /proc/version. No elevated privileges required. Example: chmod +x check_cve_2026_68138.sh && ./check_cve_2026_68138.sh

#!/bin/bash\n# CVE-2026-68138 Checker - qdisc_rtab_list race condition\n# Checks kernel version and cls_flower module availability\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\nKERNEL_VERSION=$(uname -r)\nMAJOR=$(echo "$KERNEL_VERSION" | cut -d. -f1)\nMINOR=$(echo "$KERNEL_VERSION" | cut -d. -f2)\nPATCH=$(echo "$KERNEL_VERSION" | cut -d. -f3 | cut -d- -f1)\n\n# Check if kernel is in affected range: 5.1 through 7.1.5\nif [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then\n  echo "UNKNOWN - Could not parse kernel version: $KERNEL_VERSION"\n  exit 2\nfi\n\n# Kernels before 5.1 are not affected\nif [ "$MAJOR" -lt 5 ]; then\n  echo "PATCHED - Kernel $KERNEL_VERSION predates the vulnerable commit (5.1+)"\n  exit 0\nfi\nif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -lt 1 ]; then\n  echo "PATCHED - Kernel $KERNEL_VERSION predates the vulnerable commit (5.1+)"\n  exit 0\nfi\n\n# Kernels 7.2+ are fixed (mainline fix in 7.2-rc5)\nif [ "$MAJOR" -gt 7 ]; then\n  echo "PATCHED - Kernel $KERNEL_VERSION is past the fix (7.2-rc5+)"\n  exit 0\nfi\nif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 2 ]; then\n  echo "PATCHED - Kernel $KERNEL_VERSION includes the fix (7.2-rc5+)"\n  exit 0\nfi\n\n# Kernel 7.1.6+ is fixed (stable backport)\nif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 6 ]; then\n  echo "PATCHED - Kernel $KERNEL_VERSION includes the stable fix (7.1.6+)"\n  exit 0\nfi\n\n# Check for distro-specific backport by looking for the fix commit in changelogs\n# This is best-effort; distro kernels may backport without changing the version\nif grep -q 'qdisc_rtab_lock' /proc/kallsyms 2>/dev/null; then\n  echo "PATCHED - Kernel $KERNEL_VERSION has qdisc_rtab_lock symbol (backport detected)"\n  exit 0\nfi\n\n# Check if cls_flower is available (required for exploitation)\nFLOWER_LOADED=false\nif lsmod 2>/dev/null | grep -q cls_flower; then\n  FLOWER_LOADED=true\nfi\nFLOWER_AVAILABLE=false\nif modinfo cls_flower >/dev/null 2>&1; then\n  FLOWER_AVAILABLE=true\nfi\n\necho "VULNERABLE - Kernel $KERNEL_VERSION is in the affected range (5.1 - 7.1.5)"\nif [ "$FLOWER_LOADED" = true ]; then\n  echo "  WARNING: cls_flower module is currently LOADED"\nelif [ "$FLOWER_AVAILABLE" = true ]; then\n  echo "  NOTE: cls_flower module is available but not loaded"\nelse\n  echo "  MITIGATING: cls_flower module not found (exploitation unlikely)"\nfi\nexit 1

Sources

1. PoC Exploit by A. Ramos
2. Vulert - Race Condition in net: sched
3. Red Hat Security Advisory RHSA-2026:49033
4. LWN.net - Stable kernel security fixes
5. NVD - National Vulnerability Database
6. CISA KEV Catalog
7. Infosecurity Magazine - AI-Assisted Bug Hunt in net/sched