CVE-2026-98017

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98017", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.069Z", "datePublished": "2026-09-25T10:23:39.107Z", "dateUpdated": "2026-10-19T09:12:22.590Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:22.590Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders. If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The trigger is a local rtnetlink RTM_NEWQDISC message (tc_modify_qdisc -> qdisc_create) with a clsact kind, a shared TCA_INGRESS_BLOCK and an invalid TCA_RATE. Packets only drive the reader side (tc_run), and no remote peer supplies the input that causes the bug.\nAC:L - The attacker controls both sides of the race: they repeat the failing clsact create, which runs qdisc_free() with no grace period, while pushing traffic through their own veth/dummy device so that tc_run() dereferences the published miniq. No outside condition is needed.\nPR:L - tc_modify_qdisc only needs CAP_NET_ADMIN in the netns that owns the device, which an unprivileged user gets through unshare -Urn plus a self-created veth/dummy interface. That makes it reachable as PR:L rather than requiring init-namespace root.\nUI:N - The attacker performs every step themselves: creating the shared block and filter, sending the failing RTM_NEWQDISC, and generating traffic. No victim action is needed.\nS:U - The use-after-free and any resulting privilege escalation stay inside the same kernel security authority. No hypervisor or IOMMU boundary is crossed.\nC:H - The mini_Qdisc embedded in the freed qdisc (a kmalloc'd object, so its slot can be reclaimed) is read by tc_run: miniq->block and miniq->filter_list are passed to tcf_classify. With a sprayed replacement object, the attacker controls these pointers, which can be used to leak kernel memory.\nI:H - tc_run calls mini_qdisc_bstats_cpu_update(), which writes through the cpu_bstats pointer taken from the freed object, and tcf_classify follows a filter_list the attacker can control. After reclaim, this gives a controlled write and a path to hijacking control flow.\nA:H - Freeing the qdisc while RCU readers in tc_run still hold its embedded miniq leads to KASAN splats and oopses when the packet path touches the freed or reallocated memory. The result is a kernel crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_api.c", "net/sched/sch_generic.c"], "versions": [{"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "lessThan": "96a27a3e64e7c87abade03fb2ad04ed66992a89a", "status": "affected", "versionType": "git"}, {"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "lessThan": "6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d", "status": "affected", "versionType": "git"}, {"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e", "status": "affected", "versionType": "git"}, {"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e", "status": "affected", "versionType": "git"}, {"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "lessThan": "5bfe927c5b4b290fad529186218c728589b4b101", "status": "affected", "versionType": "git"}, {"version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_api.c", "net/sched/sch_generic.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a"}, {"url": "https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d"}, {"url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"}, {"url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"}, {"url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"}, {"url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"}], "title": "net/sched: defer qdisc freeing after failed creation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_api.c", "net/sched/sch_generic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "96a27a3e64e7c87abade03fb2ad04ed66992a89a", "status": "affected", "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "versionType": "git"}, {"lessThan": "6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d", "status": "affected", "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "versionType": "git"}, {"lessThan": "20bf6fa34b345333971bd4464a322cce87b83f4e", "status": "affected", "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "versionType": "git"}, {"lessThan": "156a3bab69744e9225bb9eff8c5cc53da18d5a2e", "status": "affected", "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "versionType": "git"}, {"lessThan": "5bfe927c5b4b290fad529186218c728589b4b101", "status": "affected", "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "versionType": "git"}, {"lessThan": "e6662f2100f8d33b0f4d0047c219efd6bba186ea", "status": "affected", "version": "51ab2994c387c80b45caf8b8067b3f3b97771d25", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/sch_generic.h", "net/sched/sch_api.c", "net/sched/sch_generic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders. If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain."}], "id": "CVE-2026-98017", "lastModified": "2026-10-19T10:17:55.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:30.147", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/sched: defer qdisc freeing after failed creation", "id": "2541079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541079"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: defer qdisc freeing after failed creation\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders. If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain.", "A flaw was found in the Linux kernel's network traffic control subsystem. This flaw allows a local user with network administration privileges to cause a denial of service (DoS) or potentially escalate privileges. A use-after-free condition occurs when the kernel prematurely deallocates network queueing structures after a failed configuration request while concurrent packet processing routines are still referencing them."], "name": "CVE-2026-98017", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98017\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98017\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98017.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[51ab2994c387c80b45caf8b8067b3f3b97771d25,20bf6fa34b345333971bd4464a322cce87b83f4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[51ab2994c387c80b45caf8b8067b3f3b97771d25,156a3bab69744e9225bb9eff8c5cc53da18d5a2e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[51ab2994c387c80b45caf8b8067b3f3b97771d25,5bfe927c5b4b290fad529186218c728589b4b101)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[51ab2994c387c80b45caf8b8067b3f3b97771d25,e6662f2100f8d33b0f4d0047c219efd6bba186ea)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.142178+00:00", "updated": "2026-10-01T01:45:16.945181+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}