cve 2026 64530

CVE-2026-64530 is a critical use-after-free vulnerability in the Linux kernel's traffic-control subsystem, scored 9.8 on the CVSS 3.1 scale. The flaw arises from an interaction between the RED queueing discipline, qevents, a TC filter block, and the connection-tracking ct action when processing out-of-order IP fragments. This WindowsForum thread discusses the kernel fix that stops the issue, offering guidance for Linux administrators and security teams. The vulnerability has a network attack vector and requires no privileges or user interaction, though real-world exposure depends on specific traffic-control configurations. The discussion focuses on the technical details and remediation steps for this Linux kernel flaw.