CVE-2026-98017: net/sched: defer qdisc freeing after failed creation
In the Linux kernel, the following vulnerability has been resolved:
net/sched: defer qdisc freeing after failed creation
An RTMNEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded miniQdisc to lockless readers. If the same request has an invalid TCARATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tcrun() may still hold it.
Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the race to occur?
A requester must issue an RTM_NEWQDISC request that causes clsact to bind a populated shared ingress block during initialization, then include an invalid TCA_RATE so estimator setup fails. The race also requires tc_run() to concurrently retain the published embedded mini_Qdisc.
Is normal packet processing by itself sufficient to trigger the issue?
No. The issue depends on a failed RTM_NEWQDISC creation request after initialization has published the qdisc state; concurrent lockless tc_run() activity creates the use-after-free window.
How can maintainers check whether their kernel includes the fix?
Check whether the kernel contains the change that retires qdiscs from failed creation through the same RCU helper used for normal destruction. The provided stable references identify commits 20bf6fa34b345333971bd4464a322cce87b83f4e, 156a3bab69744e9225bb9eff8c5cc53da18d5a2e, and 5bfe927c5b4b290fad529186218c728589b4b101.