Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98017

net/sched: defer qdisc freeing after failed creation

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2.7
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 51ab2994c387c80b45caf8b8067b3f3b97771d25 · fixed in 96a27a3e64e7c87abade03fb2ad04ed66992a89a; From 51ab2994c387c80b45caf8b8067b3f3b97771d25 · fixed in 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d; From 51ab2994c387c80b45caf8b8067b3f3b97771d25 · fixed in 20bf6fa34b345333971bd4464a322cce87b83f4e; From 51ab2994c387c80b45caf8b8067b3f3b97771d25 · fixed in 156a3bab69744e9225bb9eff8c5cc53da18d5a2e; From 51ab2994c387c80b45caf8b8067b3f3b97771d25 · fixed in 5bfe927c5b4b290fad529186218c728589b4b101; From 51ab2994c387c80b45caf8b8067b3f3b97771d25 · fixed in e6662f2100f8d33b0f4d0047c219efd6bba186ea

  • Linux Linux

    4.16

  • KernelLinux

    From 4.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7

References 6

git.kernel.org