🟠 High | Source: Microsoft Security Response Center
CVE-2026-64530 is a Linux kernel vulnerability in the traffic control (net/sched) subsystem, specifically in the cls_api component, where the TC_ACT_CONSUMED return code is not correctly handled by tcf_qevent_handle. This flaw can lead to undefined behaviour in network packet processing, potentially enabling denial of service or memory corruption in affected environments. Azure workloads running Linux-based virtual machines or containers may be exposed if the underlying kernel is unpatched.
Security Architect’s Take: Review whether your Azure Linux VMs, AKS node pools, or container hosts are running kernel versions affected by this flaw, and prioritise applying the relevant kernel patch or OS update via Azure Update Manager or your existing patching pipeline. If patching is delayed, consider restricting untrusted user access to network namespaces as a compensating control.
Original advisory: CVE-2026-64530 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle