CVE-2026-97616
Received Received - Intake

Memory Leak in Linux Kernel Traffic Control Action API

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: release all action references on NEWACTION failure When a batched RTM_NEWACTION request replaces an existing action, tcf_idr_check_alloc() takes a temporary reference on it. If a later action fails to initialize, tcf_action_destroy() uses strict release semantics to clean up the actions initialized so far. For an action bound to a filter, the strict check returns -EPERM without dropping the temporary reference. This error also makes tcf_action_destroy() return before releasing subsequent entries. Any new action initialized between the bound action and the failing entry is leaked together with its reserved IDR slot, preventing reuse of its index. Use tcf_idr_release() to drop each reference held by the batch without rejecting bound actions. This allows cleanup to continue through all initialized entries and preserves the module reference release when an action is destroyed. Explicit action deletion and flushing retain their separate bind-count checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97616
EUVD
EUVD-2026-86747

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when a batch request to replace an existing network action fails during initialization. The system attempts to clean up by releasing references to initialized actions, but due to strict reference checks, it fails to release bound actions properly. This causes memory leaks where new actions and their reserved IDR slots are not freed, preventing reuse of their indices.

Detection Guidance

This vulnerability is specific to the Linux kernel's traffic control subsystem and does not have direct network or system detection commands. It requires kernel-level inspection for action reference leaks during RTM_NEWACTION operations. Monitor kernel logs for errors related to tcf_action_destroy or IDR slot leaks after batch action operations.

Impact Analysis

This vulnerability could lead to resource exhaustion in the Linux kernel, particularly memory and IDR slots, due to leaked actions. It may cause system instability, crashes, or degraded performance if exploited repeatedly. Systems relying on network action management could experience failures in processing or updating network policies.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory leak issue in network action handling that could lead to resource exhaustion but does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the latest Linux kernel patches that resolve this issue. Avoid using batched RTM_NEWACTION requests until patched. If batched actions are necessary, manually verify all actions are properly initialized and released after each operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart