net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). If a netlink socket sends RTM_GETCHAIN requests repeatedly without recv()ing the responses, tc_ctl_chain() hogs CPU and triggers Hung Task splat. [0] As caught in the stack trace, netlink_attachskb() could confuse tc_ctl_chain() by returning -EAGAIN when the userspace netlink socket's receive buffer is full. The replay: label exists since commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi") but was not used initially. Since commit 9f407f1768d3 ("net: sched: introduce chain templates"), the label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops() may release RTNL to call request_module(). However, the replay logic is unnecessary for RTM_GETCHAIN. Let's apply the replay logic only for RTM_NEWCHAIN. [0]: INFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022. task:repro state:R running task stack:14096 pid:1022 tgid:1014 ppid:961 task_flags:0x400040 flags:0x00080000 Call Trace: ? clockevents_program_event (kernel/time/clockevents.c:372) ? pskb_expand_head (net/core/skbuff.c:615) ? skb_release_data (net/core/skbuff.c:1122) ? netlink_attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af_netlink.c:1232) ? __netlink_lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af_netlink.c:499) ? tc_chain_notify (net/sched/cls_api.c:3045) ? tc_chain_notify (
CVE-2026-97958
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97958
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "240251a4ca7cda213103694b6e21c4a5745e5d8b",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "9a0f07f7dbd1bfe8c2fd03ad055e9e60a703d5df",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "6558b0d46c5941ed1aa67da8878e224c54239cc5",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "96c2fc5daf983af2e0c1256c31e89c1f3f855279",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "a1c2840d95af1fa3d83ba71e23fa0c674a4c6796",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "503ba58481e3ba69d28127d35a39cec529f9670c",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "e9ac395bb56122a057d0aa91a6b55d9e3fa37c26",
"versionType": "git"
},
{
"status": "affected",
"version": "2ed9db3074fcd8d12709fe40ff0e691d74229818",
"lessThan": "dff39930ad5e53d202bfdfb14687d1d2fd753b4d",
"versionType": "git"
}
],
"programFiles": [
"net/sched/cls_api.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sched/cls_api.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-97958
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38098 · Revision 1
- Added to Heist Feed
- Publisher date