{"id":"CVE-2026-90248","revision":"ebef03a85850493a9345a99372a50d15","records":[{"revision":"ebef03a85850493a9345a99372a50d15","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90248","aliases":[],"title":"net/sched: cls_api: fix teardown of an adopted proto on insert-race loss","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: fix teardown of an adopted proto on insert-race loss\n\nIn tc_new_tfilter() the create branch sets tp_created = 1 before calling\ntcf_chain_tp_insert_unique(). When the caller loses the race (another\nrequest inserted a proto at the same chain/prio first), insert_unique()\ndestroys the caller's own tp_new and returns the winner's proto with an\nextra reference. tp_created was never cleared, so the loser's errout\npath treated the winner's live proto as its own and called\ntcf_chain_tp_delete_empty() on it, silently unlinking an active\nclassifier that the winning request already advertised via\nRTM_NEWTFILTER.\n\nTrack the outcome of the insert step in a single tri-state variable so\neach errout path reacts correctly:\n\n- TP_NOT_CREATED: no proto created; pursue the old path.\n- TP_CREATED: proto inserted successfully; same code path as before.\n- TP_NOT_OWNED: New - lost the insert race; tp is another request's proto\n  (chain ref already released by tp_new's destroy)\n\nBoth errout reactions are single expressions derived from the state.\n\nThis fix is motivated by the Sashiko's automated review of Patch\n(net/sched: cls_api: Always acquire rtnl_lock when destroying locked\nclassifiers) [1][2]. The review identified the silent-unlink behaviour of\nan adopted proto's teardown when a request loses the\ntcf_chain_tp_insert_unique() race.\n\n[1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com\n[2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com","state":0,"publishedAt":"2026-09-17T16:07:50.104+00:00","modifiedAt":"2026-10-19T09:00:24.022+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/cls_api.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"a68e664ddf16ecae6d769d6a2eb356f8abab75c9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"df02b6dc136af45e92ee4c86f4aa6c9a60790b1e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"bee2208276c8e0e40a249ffdcf6e5434a79a847c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"219c87aeefdcc8c1caf28cc99e9b361ce7393d3a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"bbe2fd6d77df630356185406a97317f6aa6a92cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"dc8b33b819cb02a75936940c120aa669ad89942d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8b64678e0af8f4d62a40149baedebe78503a5255\",\n                            \"lessThan\": \"d4e359b3608a0e184bbe8d61a5c3b50d0831c44a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/cls_api.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/a68e664ddf16ecae6d769d6a2eb356f8abab75c9","https://git.kernel.org/stable/c/df02b6dc136af45e92ee4c86f4aa6c9a60790b1e","https://git.kernel.org/stable/c/bee2208276c8e0e40a249ffdcf6e5434a79a847c","https://git.kernel.org/stable/c/219c87aeefdcc8c1caf28cc99e9b361ce7393d3a","https://git.kernel.org/stable/c/bbe2fd6d77df630356185406a97317f6aa6a92cf","https://git.kernel.org/stable/c/dc8b33b819cb02a75936940c120aa669ad89942d","https://git.kernel.org/stable/c/d4e359b3608a0e184bbe8d61a5c3b50d0831c44a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90248","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90248","identifiers":["CVE-2026-90248"]},"retained":false,"historicalAffected":[]}],"coverage":[]}