CVE-2026-68138 is a race condition in the kernel's qdisc rate-table subsystem (qdisc_rtab_list) that manifests as heap corruption with system-wide impact. The vulnerability was not introduced by new buggy code—it was exposed when cls_flower was optimized with TCF_PROTO_OPS_DOIT_UNLOCKED to reduce RTNL contention. That optimization removed an implicit serialization contract that the rate-table code had relied on for years without any explicit lock or documentation.
The rate-table code manipulated qdisc_rtab_list without its own synchronization because every caller historically held RTNL. The cls_flower optimization broke that assumption without touching the rate-table code at all—only by calling through a path that no longer acquired RTNL. The result is a classic invariant collapse: code that was accidentally safe became genuinely unsafe through a change that looked unrelated. The fix (adding a dedicated spinlock) is straightforward, but the lesson extends beyond this specific bug.
The blast radius is amplified by qdisc_rtab_list being global rather than per-network-namespace. A race triggered from an unprivileged container can corrupt a system-wide shared object, affecting all network namespaces simultaneously. This is not a container escape, but it is a path from less privileged network operations to kernel heap corruption with cross-namespace impact—a meaningfully different threat model than typical netns-local races.
For defenders: check that your kernels include the spinlock fix for qdisc_rtab_list (the commit adds qdisc_rtab_lock). More importantly, audit other net/sched code paths that manipulate global objects without explicit locks and which historically relied on RTNL serialization. The pattern here—code that worked because callers happened to hold a lock rather than because it was designed to be thread-safe—is likely present elsewhere in the networking stack. Prioritize global objects that are accessed from multiple call contexts, especially those involved in ongoing performance optimizations that may remove RTNL dependencies.