CVE-2026-98017

Received Received - Intake

Linux Kernel Net Sched Qdisc Creation Failure

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98017

EUVD

EUVD-2026-86670

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of network queueing disciplines (qdiscs). When a request to create a new qdisc fails due to an invalid rate setting, the system attempts to free the qdisc while it may still be in use by other processes. This can lead to a use-after-free condition, where freed memory is accessed, potentially causing system instability or crashes.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's traffic control (qdisc) subsystem. Detection requires checking for kernel logs or crashes related to qdisc operations. Monitor system logs for errors like 'qdisc freeing' or 'clsact bind' failures. Use 'dmesg | grep qdisc' or 'journalctl -k | grep qdisc' to search for related errors.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or execute arbitrary code with kernel privileges. This may result in denial-of-service conditions, data corruption, or unauthorized access to sensitive information. Systems running vulnerable Linux kernel versions are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a Linux kernel network subsystem issue involving qdisc freeing during failed creation. No evidence suggests data exposure or privacy violations that would impact these standards.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. If immediate patching is not possible, avoid using RTM_NEWQDISC with invalid TCA_RATE parameters. Monitor network traffic for unusual behavior and consider disabling clsact qdisc temporarily if feasible.

Hi! I’m here to help you understand CVE-2026-98017. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70