net/sched: cls_api: reclaim an empty proto on the error path
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on the shared proto and both can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up because the loser's handle is still in the idr, and the loser's error path drops only its own reference without a second reclamation attempt. The empty proto stays linked in the chain, holding the chain reference, a block reference and the classifier module reference until the chain or block is torn down. Reclaim the proto on the error path of any failed request that holds a proto reference. The reclamation is emptiness-gated: tcf_chain_tp_delete_empty() unlinks the proto only when delete_empty() admits it is empty, so a live shared proto is never unlinked. A proto the request created is reclaimed unconditionally - it is the only owner, so marking it for deletion is safe even without a delete_empty callback. Classifiers without one (the check marks the proto unconditionally) are rtnl-serialized, so the raced window this guard closes cannot arise for them. This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix teardown of an adopted proto on insert-race loss"), which stopped the loser of the insert race from unlinking the winner's live proto but left the empty-proto residual in place. Conditions to recreate: - CONFIG_NET_CLS_FLOWER=y; veth pa
CVE-2026-98811
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98811
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8b64678e0af8f4d62a40149baedebe78503a5255",
"lessThan": "0fc74e7d97d232095ce64cb45d25f0919df7ad4a",
"versionType": "git"
},
{
"status": "affected",
"version": "8b64678e0af8f4d62a40149baedebe78503a5255",
"lessThan": "315e4fe65cf02ef052de5e6298c3088e448b7517",
"versionType": "git"
},
{
"status": "affected",
"version": "8b64678e0af8f4d62a40149baedebe78503a5255",
"lessThan": "ebc9611ab154c0cd9f1320e2a73f5e936d7535a9",
"versionType": "git"
},
{
"status": "affected",
"version": "8b64678e0af8f4d62a40149baedebe78503a5255",
"lessThan": "570141625d212fbbcffb9665cb45c0f04610e61a",
"versionType": "git"
},
{
"status": "affected",
"version": "8b64678e0af8f4d62a40149baedebe78503a5255",
"lessThan": "0bb8eab29b55045281a4963d4557f2776cdf8cfa",
"versionType": "git"
}
],
"programFiles": [
"net/sched/cls_api.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sched/cls_api.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98811
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48988 · Revision 1
- Added to Heist Feed
- Publisher date