CVE-2026-72338: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_pedit: fix TOCTOU heap OOB write in
Summary
A TOCTOU race condition (a vulnerability where data changes between when it's checked and when it's used) existed in the Linux kernel's network packet scheduling module, allowing an attacker with admin privileges to write beyond allocated memory boundaries. The fix involves reading the key count value while holding a lock in all relevant locations and adding stricter capacity checks that reject operations exceeding available space rather than silently truncating them.
Solution / Mitigation
The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places using a new tcf_pedit_nkeys_locked() function which replaces the old tcf_pedit_nkeys(). Additionally, remaining capacity checks are enforced, returning -ENOSPC (no space error) if the required space exceeds remaining capacity, rather than silently truncating the key count.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72338
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%