All vulnerabilities
CVE-2026-97616

Linux: net/sched: act_api: release all action references on NEWACTION failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1b5730a1c7def8993b3feba764008d1ff5c9dceaAlso 64b36eaef6ea5ada9aea4c2cf87099aaa8a4869b, 048617743febf6530111cfb594e9bbbd7918bf67 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1b5730a1c7def8993b3feba764008d1ff5c9dceaLinuxCVE List
  • 64b36eaef6ea5ada9aea4c2cf87099aaa8a4869bLinuxCVE List
  • 048617743febf6530111cfb594e9bbbd7918bf67LinuxCVE List
  • 478eb5abb51931a152abab068f8a717b7ff480fdLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: release all action references on NEWACTION failure

When a batched RTM_NEWACTION request replaces an existing action, tcf_idr_check_alloc() takes a temporary reference on it. If a later action fails to initialize, tcf_action_destroy() uses strict release semantics to clean up the actions initialized so far. For an action bound to a filter, the strict check returns -EPERM without dropping the temporary reference.

This error also makes tcf_action_destroy() return before releasing subsequent entries. Any new action initialized between the bound action and the failing entry is leaked together with its reserved IDR slot, preventing reuse of its index.

Use tcf_idr_release() to drop each reference held by the batch without rejecting bound actions. This allows cleanup to continue through all initialized entries and preserves the module reference release when an action is destroyed. Explicit action deletion and flushing retain their separate bind-count checks.

Text from CVE List

Affected versions 12

  • Linuxaffected: 55334a5db5cd32b207ac697cec3ec8e078f345d4 before 1b5730a1c7def8993b3feba764008d1ff5c9dceaCVE List
  • Linuxaffected: 55334a5db5cd32b207ac697cec3ec8e078f345d4 before f908c8a969946a45225fd7f9d9a85771e12ae0a8CVE List
  • Linuxaffected: 55334a5db5cd32b207ac697cec3ec8e078f345d4 before 64b36eaef6ea5ada9aea4c2cf87099aaa8a4869bCVE List
  • Linuxaffected: 55334a5db5cd32b207ac697cec3ec8e078f345d4 before 048617743febf6530111cfb594e9bbbd7918bf67CVE List
  • Linuxaffected: 55334a5db5cd32b207ac697cec3ec8e078f345d4 before 478eb5abb51931a152abab068f8a717b7ff480fdCVE List
  • Linuxaffected: 3.15CVE List
  • Linuxunaffected: all versions before 3.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5