CVE-2026-98811

Received Received - Intake

Double Free in Linux Kernel Net Sched

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on the shared proto and both can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up because the loser's handle is still in the idr, and the loser's error path drops only its own reference without a second reclamation attempt. The empty proto stays linked in the chain, holding the chain reference, a block reference and the classifier module reference until the chain or block is torn down. Reclaim the proto on the error path of any failed request that holds a proto reference. The reclamation is emptiness-gated: tcf_chain_tp_delete_empty() unlinks the proto only when delete_empty() admits it is empty, so a live shared proto is never unlinked. A proto the request created is reclaimed unconditionally - it is the only owner, so marking it for deletion is safe even without a delete_empty callback. Classifiers without one (the check marks the proto unconditionally) are rtnl-serialized, so the raced window this guard closes cannot arise for them. This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix teardown of an adopted proto on insert-race loss"), which stopped the loser of the insert race from unlinking the winner's live proto but left the empty-proto residual in place. Conditions to recreate: - CONFIG_NET_CLS_FLOWER=y; veth pair - tc qdisc add dev veth0 ingress - two concurrent `tc filter add dev veth0 ingress protocol ip pref 1 flower skip_sw ... action drop` (both fail in fl_hw_replace_filter after publishing their handle in the idr); repeat in a loop - an empty flower tp stays linked after both requests fail; visible as a bare `filter protocol ip pref 1 flower chain 0` header in `tc filter show` with no filter entries - CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98811

EUVD

EUVD-2026-103896

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	8b64678e0af8f4d62a40149baedebe78503a5255
Linux	Linux	8b64678e0af8f4d62a40149baedebe78503a5255
Linux	Linux	8b64678e0af8f4d62a40149baedebe78503a5255
Linux	Linux	8b64678e0af8f4d62a40149baedebe78503a5255
Linux	Linux	5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the traffic control (tc) filter subsystem. When two concurrent requests attempt to add a filter on the same chain and priority, both may fail. The loser's error path fails to properly clean up a shared protocol object, leaving an empty protocol linked in the chain. This causes the chain to retain unnecessary references until manually torn down.

Detection Guidance

Detect this vulnerability by checking for empty tc filter entries on your system. Use the command 'tc filter show' to inspect filter chains. Look for entries with no actual filter rules, such as a bare 'filter protocol ip pref 1 flower chain 0' header with no subsequent filter details.

Impact Analysis

An attacker with CAP_NET_ADMIN privileges could exploit this to cause resource leaks in the kernel. This may lead to denial-of-service conditions by exhausting system resources or destabilizing network traffic control operations. The impact is limited to systems using unlocked classifiers with specific configurations like CONFIG_NET_CLS_FLOWER.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network traffic control (tc) filter handling, which could lead to resource leaks but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. Ensure your kernel version includes the fix for the cls_api flaw. Monitor vendor advisories for updates and reboot systems if necessary to load patched kernels.

Hi! I’m here to help you understand CVE-2026-98811. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70