CVE-2026-98017 (GCVE-0-2026-98017)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-19 09:12
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.
References
Impacted products
Vendor Product Version
Linux Linux Version: 51ab2994c387c80b45caf8b8067b3f3b97771d25
Version: 51ab2994c387c80b45caf8b8067b3f3b97771d25
Version: 51ab2994c387c80b45caf8b8067b3f3b97771d25
Version: 51ab2994c387c80b45caf8b8067b3f3b97771d25
Version: 51ab2994c387c80b45caf8b8067b3f3b97771d25
Version: 51ab2994c387c80b45caf8b8067b3f3b97771d25
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96a27a3e64e7c87abade03fb2ad04ed66992a89a",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "5bfe927c5b4b290fad529186218c728589b4b101",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during -\u003einit(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after -\u003einit(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a local rtnetlink RTM_NEWQDISC message (tc_modify_qdisc -\u003e qdisc_create) with a clsact kind, a shared TCA_INGRESS_BLOCK and an invalid TCA_RATE. Packets only drive the reader side (tc_run), and no remote peer supplies the input that causes the bug.\nAC:L - The attacker controls both sides of the race: they repeat the failing clsact create, which runs qdisc_free() with no grace period, while pushing traffic through their own veth/dummy device so that tc_run() dereferences the published miniq. No outside condition is needed.\nPR:L - tc_modify_qdisc only needs CAP_NET_ADMIN in the netns that owns the device, which an unprivileged user gets through unshare -Urn plus a self-created veth/dummy interface. That makes it reachable as PR:L rather than requiring init-namespace root.\nUI:N - The attacker performs every step themselves: creating the shared block and filter, sending the failing RTM_NEWQDISC, and generating traffic. No victim action is needed.\nS:U - The use-after-free and any resulting privilege escalation stay inside the same kernel security authority. No hypervisor or IOMMU boundary is crossed.\nC:H - The mini_Qdisc embedded in the freed qdisc (a kmalloc\u0027d object, so its slot can be reclaimed) is read by tc_run: miniq-\u003eblock and miniq-\u003efilter_list are passed to tcf_classify. With a sprayed replacement object, the attacker controls these pointers, which can be used to leak kernel memory.\nI:H - tc_run calls mini_qdisc_bstats_cpu_update(), which writes through the cpu_bstats pointer taken from the freed object, and tcf_classify follows a filter_list the attacker can control. After reclaim, this gives a controlled write and a path to hijacking control flow.\nA:H - Freeing the qdisc while RCU readers in tc_run still hold its embedded miniq leads to KASAN splats and oopses when the packet path touches the freed or reallocated memory. The result is a kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:12:22.590Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d"
        },
        {
          "url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"
        }
      ],
      "title": "net/sched: defer qdisc freeing after failed creation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98017",
    "datePublished": "2026-09-25T10:23:39.107Z",
    "dateReserved": "2026-09-25T10:19:56.069Z",
    "dateUpdated": "2026-10-19T09:12:22.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.