{"id":"CVE-2026-98017","revision":"e3c68f8008154e71b942fda8ae38c01f","records":[{"revision":"e3c68f8008154e71b942fda8ae38c01f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98017","aliases":[],"title":"net/sched: defer qdisc freeing after failed creation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain.","state":0,"publishedAt":"2026-09-25T10:23:39.107+00:00","modifiedAt":"2026-10-19T09:12:22.59+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/sch_generic.h\",\n                        \"net/sched/sch_api.c\",\n                        \"net/sched/sch_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"51ab2994c387c80b45caf8b8067b3f3b97771d25\",\n                            \"lessThan\": \"96a27a3e64e7c87abade03fb2ad04ed66992a89a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"51ab2994c387c80b45caf8b8067b3f3b97771d25\",\n                            \"lessThan\": \"6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"51ab2994c387c80b45caf8b8067b3f3b97771d25\",\n                            \"lessThan\": \"20bf6fa34b345333971bd4464a322cce87b83f4e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"51ab2994c387c80b45caf8b8067b3f3b97771d25\",\n                            \"lessThan\": \"156a3bab69744e9225bb9eff8c5cc53da18d5a2e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"51ab2994c387c80b45caf8b8067b3f3b97771d25\",\n                            \"lessThan\": \"5bfe927c5b4b290fad529186218c728589b4b101\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"51ab2994c387c80b45caf8b8067b3f3b97771d25\",\n                            \"lessThan\": \"e6662f2100f8d33b0f4d0047c219efd6bba186ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/sch_generic.h\",\n                        \"net/sched/sch_api.c\",\n                        \"net/sched/sch_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a","https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d","https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e","https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e","https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101","https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98017","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98017","identifiers":["CVE-2026-98017"]},"retained":false,"historicalAffected":[]}],"coverage":[]}