ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the Linux Kernel's Net Scheduler Packet Classifier API, tracked as ZDI-26-575 and CVE-2026-31419. This flaw could allow an attacker to execute code with kernel-level privileges.

The vulnerability stems from a time-of-check time-of-use (TOCTOU) race condition within the traffic classifier component. Specifically, the issue is attributed to insufficient locking mechanisms during operations performed on an object, creating a window where an attacker could manipulate the system state between a security check and its subsequent use.

To exploit this vulnerability, an attacker must first establish a foothold on the target system and possess the ability to execute high-privileged code. Once these prerequisites are met, the TOCTOU flaw could be leveraged to elevate privileges and run arbitrary code within the kernel's context.

The vulnerability was reported to the Linux vendor on June 25, 2026. A coordinated public release of an advisory, along with an update to address the issue, occurred on August 13, 2026.

Linux has released a patch to correct this vulnerability. Further details regarding the fix are available in a commit on the official Linux GitHub repository, identified by the hash 8b519cbcabe836a441369fbec1a8a6518a709251. The discovery of this vulnerability is credited to TristanInSec.