DEBIAN-CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved:  net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle  tcfclassify() can return TCACTCONSUMED while the skb is held by the defragmentation engine (e.g. actct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again.  tcfqeventhandle() did not handle TCACTCONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qemark on REDPROBMARK/HARDMARK, qeearlydrop on congestiondrop) redenqueue() was continuing to operate on an skb it no longer owns  in this case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.    tc qdisc add dev eth0 root handle 1: red ... qevent earlydrop block 10   tc filter add block 10 ... action ct    (with ct defrag enabled and traffic that produces out-of-order   fragments, e.g. a fragmented UDP stream)  Handle TCACTCONSUMED in tcfqeventhandle() the same way the ingress and egress fast paths do: treat it as stolen and return NULL without touching the skb. Unlike the TCACTSTOLEN case, the skb must not be dropped/freed here, as it is no longer owned by us.