Linux Kernel Net Scheduler TOCTUO Flaw (ZDI‑26‑575) Enables Local Privilege Escalation
What Happened — A TOCTOU (time‑of‑check‑time‑of‑use) flaw in the Linux kernel’s Net Scheduler packet‑classifier API allows a local attacker to gain kernel‑level privileges. The issue stems from missing locking when operating on classifier objects, letting an attacker execute code in the kernel context after first obtaining limited high‑privileged execution. Linux has published a patch to remediate the defect.
Why It Matters for Compliance & Audit Readiness
- The vulnerability directly violates SOC 2 CC6.1 (Logical Access) by exposing a gap in privileged‑access protection.
- Continuous‑compliance programs must demonstrate timely patch management and evidence that privileged‑access controls are enforced and monitored.
- Verisq’s SOC 2 Access Controls capability provides automated tracking of kernel‑level patches and audit‑ready logs to prove remediation.
Who Is Affected — Cloud‑infrastructure providers, SaaS platforms, and any organization running unpatched Linux kernels (e.g., IaaS, PaaS, on‑prem data‑center workloads).
Recommended Actions
- Verify kernel version across all Linux assets; apply the upstream patch immediately.
- Map the patch‑management process to SOC 2 CC6.1 and CC7.1 (System Operations) controls; capture patch‑install logs as audit evidence.
- Integrate continuous vulnerability scanning with a control‑evidence repository to demonstrate ongoing compliance.
Technical Notes
- CVSS 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Exploits require local code execution; the flaw resides in the traffic‑classifier code path of the Net Scheduler subsystem.
- Patch available at: https://github.com/torvalds/linux/commit/8b519cbcabe836a441369fbec1a8a6518a709251.
Source: Zero Day Initiative advisory – ZDI‑26‑575