net/sched: defer qdisc freeing after failed creation
In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.
CVE-2026-98017
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98017
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
"lessThan": "96a27a3e64e7c87abade03fb2ad04ed66992a89a",
"versionType": "git"
},
{
"status": "affected",
"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
"lessThan": "6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d",
"versionType": "git"
},
{
"status": "affected",
"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
"lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e",
"versionType": "git"
},
{
"status": "affected",
"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
"lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
"versionType": "git"
},
{
"status": "affected",
"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
"lessThan": "5bfe927c5b4b290fad529186218c728589b4b101",
"versionType": "git"
},
{
"status": "affected",
"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
"lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea",
"versionType": "git"
}
],
"programFiles": [
"include/net/sch_generic.h",
"net/sched/sch_api.c",
"net/sched/sch_generic.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/sch_generic.h",
"net/sched/sch_api.c",
"net/sched/sch_generic.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98017
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #38144 · Revision 1
- Added to Heist Feed
- Publisher date