Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-98017

net/sched: defer qdisc freeing after failed creation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 51ab2994c387c80b45caf8b8067b3f3b97771d25 to < 96a27a3e64e7c87abade03fb2ad04ed66992a89aaffected
  • 51ab2994c387c80b45caf8b8067b3f3b97771d25 to < 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447daffected
  • 51ab2994c387c80b45caf8b8067b3f3b97771d25 to < 20bf6fa34b345333971bd4464a322cce87b83f4eaffected
  • 51ab2994c387c80b45caf8b8067b3f3b97771d25 to < 156a3bab69744e9225bb9eff8c5cc53da18d5a2eaffected
  • 51ab2994c387c80b45caf8b8067b3f3b97771d25 to < 5bfe927c5b4b290fad529186218c728589b4b101affected
  • 51ab2994c387c80b45caf8b8067b3f3b97771d25 to < e6662f2100f8d33b0f4d0047c219efd6bba186eaaffected

Linux Linux

Default version status: affected

  • 4.16affected
  • 0 to < 4.16unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References