Vulnerability-Lookup

FKIE_CVE-2026-98017

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 15:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "5bfe927c5b4b290fad529186218c728589b4b101",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during -\u003einit(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after -\u003einit(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."
    }
  ],
  "id": "CVE-2026-98017",
  "lastModified": "2026-09-25T15:18:03.697",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-25T11:17:30.147",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-98017 (GCVE-0-2026-98017)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 14:41

Title

net/sched: defer qdisc freeing after failed creation

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/20bf6fa34b3453339…
https://git.kernel.org/stable/c/156a3bab69744e922…
https://git.kernel.org/stable/c/5bfe927c5b4b290fa…
https://git.kernel.org/stable/c/e6662f2100f8d33b0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 , < 20bf6fa34b345333971bd4464a322cce87b83f4e (git) Affected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 , < 156a3bab69744e9225bb9eff8c5cc53da18d5a2e (git) Affected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 , < 5bfe927c5b4b290fad529186218c728589b4b101 (git) Affected: 51ab2994c387c80b45caf8b8067b3f3b97771d25 , < e6662f2100f8d33b0f4d0047c219efd6bba186ea (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "5bfe927c5b4b290fad529186218c728589b4b101",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            },
            {
              "lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea",
              "status": "affected",
              "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sch_generic.h",
            "net/sched/sch_api.c",
            "net/sched/sch_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during -\u003einit(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after -\u003einit(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a local rtnetlink RTM_NEWQDISC message (tc_modify_qdisc -\u003e qdisc_create) with a clsact kind, a shared TCA_INGRESS_BLOCK and an invalid TCA_RATE. Packets only drive the reader side (tc_run), and no remote peer supplies the input that causes the bug.\nAC:L - The attacker controls both sides of the race: they repeat the failing clsact create, which runs qdisc_free() with no grace period, while pushing traffic through their own veth/dummy device so that tc_run() dereferences the published miniq. No outside condition is needed.\nPR:L - tc_modify_qdisc only needs CAP_NET_ADMIN in the netns that owns the device, which an unprivileged user gets through unshare -Urn plus a self-created veth/dummy interface. That makes it reachable as PR:L rather than requiring init-namespace root.\nUI:N - The attacker performs every step themselves: creating the shared block and filter, sending the failing RTM_NEWQDISC, and generating traffic. No victim action is needed.\nS:U - The use-after-free and any resulting privilege escalation stay inside the same kernel security authority. No hypervisor or IOMMU boundary is crossed.\nC:H - The mini_Qdisc embedded in the freed qdisc (a kmalloc\u0027d object, so its slot can be reclaimed) is read by tc_run: miniq-\u003eblock and miniq-\u003efilter_list are passed to tcf_classify. With a sprayed replacement object, the attacker controls these pointers, which can be used to leak kernel memory.\nI:H - tc_run calls mini_qdisc_bstats_cpu_update(), which writes through the cpu_bstats pointer taken from the freed object, and tcf_classify follows a filter_list the attacker can control. After reclaim, this gives a controlled write and a path to hijacking control flow.\nA:H - Freeing the qdisc while RCU readers in tc_run still hold its embedded miniq leads to KASAN splats and oopses when the packet path touches the freed or reallocated memory. The result is a kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:50.690Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"
        }
      ],
      "title": "net/sched: defer qdisc freeing after failed creation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98017",
    "datePublished": "2026-09-25T10:23:39.107Z",
    "dateReserved": "2026-09-25T10:19:56.069Z",
    "dateUpdated": "2026-09-25T14:41:50.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-98017

CVE-2026-98017 (GCVE-0-2026-98017)

Tags

Sightings

Nomenclature

Related by attack behaviour