All vulnerabilities
CVE-2026-98017

Linux: net/sched: defer qdisc freeing after failed creation

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in96a27a3e64e7c87abade03fb2ad04ed66992a89aAlso 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d, 20bf6fa34b345333971bd4464a322cce87b83f4e and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 96a27a3e64e7c87abade03fb2ad04ed66992a89aLinuxCVE List
  • 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447dLinuxCVE List
  • 20bf6fa34b345333971bd4464a322cce87b83f4eLinuxCVE List
  • 156a3bab69744e9225bb9eff8c5cc53da18d5a2eLinuxCVE List
  • 5bfe927c5b4b290fad529186218c728589b4b101LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: defer qdisc freeing after failed creation

An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it.

Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Text from CVE List

Affected versions 14

  • Linuxaffected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 96a27a3e64e7c87abade03fb2ad04ed66992a89aCVE List
  • Linuxaffected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447dCVE List
  • Linuxaffected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 20bf6fa34b345333971bd4464a322cce87b83f4eCVE List
  • Linuxaffected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 156a3bab69744e9225bb9eff8c5cc53da18d5a2eCVE List
  • Linuxaffected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 5bfe927c5b4b290fad529186218c728589b4b101CVE List
  • Linuxaffected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 before e6662f2100f8d33b0f4d0047c219efd6bba186eaCVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6