CVE-2026-98017

net/sched: defer qdisc freeing after failed creation

State: Published
Severity: 7.8 High
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: defer qdisc freeing after failed creation

An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it.

Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 96a27a3e64e7c87abade03fb2ad04ed66992a89aAffected 51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447dAffected 51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 20bf6fa34b345333971bd4464a322cce87b83f4eAffected 51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 156a3bab69744e9225bb9eff8c5cc53da18d5a2eAffected 51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 5bfe927c5b4b290fad529186218c728589b4b101Affected 51ab2994c387c80b45caf8b8067b3f3b97771d25 to before e6662f2100f8d33b0f4d0047c219efd6bba186eaAffected
LinuxLinux	4.16Affected before 4.16Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 96a27a3e64e7c87abade03fb2ad04ed66992a89aAffected
51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447dAffected
51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 20bf6fa34b345333971bd4464a322cce87b83f4eAffected
51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 156a3bab69744e9225bb9eff8c5cc53da18d5a2eAffected
51ab2994c387c80b45caf8b8067b3f3b97771d25 to before 5bfe927c5b4b290fad529186218c728589b4b101Affected
51ab2994c387c80b45caf8b8067b3f3b97771d25 to before e6662f2100f8d33b0f4d0047c219efd6bba186eaAffected

LinuxLinux

4.16Affected
before 4.16Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.