{"id":"CVE-2026-98235","revision":"009ee366ed6043cf8f9164fc87378ebe","records":[{"revision":"009ee366ed6043cf8f9164fc87378ebe","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98235","aliases":[],"title":"net/sched: act_api: release tail references on DELACTION failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: release tail references on DELACTION failure\n\nA batched RTM_DELACTION request takes a temporary reference on each\naction before attempting any deletion. tcf_action_delete() clears\neach processed slot and drops its temporary reference before attempting\nthe deletion. If deletion fails, tca_action_gd() calls\ntcf_action_put_many() to release the remaining references, but its\ntcf_act_for_each_action() iterator stops at the first NULL slot.\n\nWhen a batch stops at an action bound to a filter, this leaks a\nreference on each subsequent action. A later delete of an unbound\naction can then return success without removing it from the IDR.\n\nWalk the full array in tcf_action_put_many() and skip NULL slots to\nrelease the references held on the unprocessed actions.","state":0,"publishedAt":"2026-10-06T08:45:07.909+00:00","modifiedAt":"2026-10-19T09:16:07.068+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/act_api.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a0e947c9ccffe47d45aca793d9e7fe4f4494e381\",\n                            \"lessThan\": \"9eaba16f1b6ee19b249e6afd82c27f958d441458\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a0e947c9ccffe47d45aca793d9e7fe4f4494e381\",\n                            \"lessThan\": \"1be63e4579af408d596f0f3165faf1a880631d3b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a0e947c9ccffe47d45aca793d9e7fe4f4494e381\",\n                            \"lessThan\": \"57b477e46ef2df3483f3488cc713c61c4b384aab\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a0e947c9ccffe47d45aca793d9e7fe4f4494e381\",\n                            \"lessThan\": \"6e05e46fa821a5c1b281355f1f622ac76cb6080a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/act_api.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/9eaba16f1b6ee19b249e6afd82c27f958d441458","https://git.kernel.org/stable/c/1be63e4579af408d596f0f3165faf1a880631d3b","https://git.kernel.org/stable/c/57b477e46ef2df3483f3488cc713c61c4b384aab","https://git.kernel.org/stable/c/6e05e46fa821a5c1b281355f1f622ac76cb6080a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98235","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98235","identifiers":["CVE-2026-98235"]},"retained":false,"historicalAffected":[]}],"coverage":[]}