CVE-2026-98017

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-25 11:17:30.147000

Last modified

2026-10-19 10:17:55.547000

View original CVE JSON

{
  "id": "CVE-2026-98017",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-25T11:17:30.147",
  "lastModified": "2026-10-19T10:17:55.547",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "lessThan": "96a27a3e64e7c87abade03fb2ad04ed66992a89a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "lessThan": "6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "lessThan": "5bfe927c5b4b290fad529186218c728589b4b101",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.189",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.158",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.111",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.53",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.7",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}