CVE-2026-98235

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: release tail references on DELACTION failure A batched RTM_DELACTION request takes a temporary reference on each action before attempting any deletion. tcf_action_delete() clears each processed slot and drops its temporary reference before attempting the deletion. If deletion fails, tca_action_gd() calls tcf_action_put_many() to release the remaining references, but its tcf_act_for_each_action() iterator stops at the first NULL slot. When a batch stops at an action bound to a filter, this leaks a reference on each subsequent action. A later delete of an unbound action can then return success without removing it from the IDR. Walk the full array in tcf_action_put_many() and skip NULL slots to release the references held on the unprocessed actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98235

EUVD

EUVD-2026-93163

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	a0e947c9ccffe47d45aca793d9e7fe4f4494e381
Linux	Linux	a0e947c9ccffe47d45aca793d9e7fe4f4494e381
Linux	Linux	a0e947c9ccffe47d45aca793d9e7fe4f4494e381
Linux	Linux	a0e947c9ccffe47d45aca793d9e7fe4f4494e381
Linux	Linux	6.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a reference leak during batch deletion of network actions. When a batched RTM_DELACTION request fails, temporary references on subsequent actions are not properly released due to an iterator stopping at the first NULL slot. This can lead to a reference leak and incorrect deletion behavior.

Detection Guidance

This vulnerability involves kernel memory leaks during batch action deletions in the Linux traffic control subsystem. Detection requires checking kernel logs for tcf_action_put_many() errors or memory leaks related to net/sched. Use commands like dmesg | grep tcf_action or journalctl -k | grep -i leak to inspect logs. Monitor system memory usage for unexpected increases.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by preventing proper cleanup of network actions. It may also lead to incorrect state management in the kernel, potentially causing system instability or unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a Linux kernel memory management issue related to action deletion in network traffic control. There is no evidence it impacts data protection or privacy controls required by these standards.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves CVE-2026-98235. Monitor kernel logs for failed RTM_DELACTION requests or reference leaks. Ensure batch deletion operations are properly handled to avoid reference leaks.

Hi! I’m here to help you understand CVE-2026-98235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70