CVE-2026-98017 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: defer qdisc freeing after failed creation
An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it.
Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability described involves a race condition and use-after-free issue within the Linux kernel’s network traffic control subsystem, specifically in the net/sched module. This flaw arises during the initialization phase of queueing disciplines (qdiscs) when handling RTM_NEWQDISC requests. The core technical failure occurs because an ingress block bound to clsact may publish a mini_Qdisc structure to lockless readers before the entire creation process is successfully completed. If subsequent validation steps, such as setting up estimators for TCA_RATE attributes, fail due to invalid input data, the system attempts to unwind and clean up the partially initialized state. However, this cleanup logic incorrectly performs a synchronous free of the qdisc structure while other kernel threads or lockless readers might still be holding references to it via rcu_read_lock contexts. This creates a window where memory is reclaimed prematurely, leading to potential use-after-free conditions that can result in kernel panics, data corruption, or arbitrary code execution if an attacker can control the input parameters triggering this path.
From a vulnerability classification perspective, this issue aligns with CWE-416: Use After Free, as it involves accessing memory after it has been freed due to improper synchronization during resource cleanup. Additionally, because the flaw allows for potential denial of service through kernel crashes and could potentially be leveraged for privilege escalation depending on the specific exploitation context, it also touches upon aspects of CWE-787: Out-of-bounds Write if the freed memory is reallocated and overwritten before being accessed again. In terms of adversary tactics, this type of vulnerability can facilitate lateral movement or persistence by destabilizing system integrity, which maps to ATT&CK technique T1059: Command and Scripting Interpreter if used in conjunction with other exploits, though primarily it represents a local privilege escalation vector via kernel exploitation techniques often categorized under Defense Evasion or Privilege Escalation paths like T1068: Exploitation for Privilege Escalation.
The operational impact of this vulnerability is significant as it affects the stability and security of Linux-based systems handling network traffic control configurations. An attacker with local access to a system could craft specific netlink messages containing malformed or invalid rate estimator parameters to trigger the race condition during qdisc creation. Successful exploitation could lead to kernel crashes, resulting in service denial for affected applications relying on that node’s networking capabilities. In more severe scenarios involving memory corruption primitives derived from the use-after-free state, an attacker might achieve arbitrary code execution with root privileges by manipulating heap layouts or overwriting function pointers within the corrupted data structures. This undermines the reliability of network infrastructure components and poses a risk to any system where untrusted users can influence traffic control configurations through netlink sockets.
Mitigation strategies primarily involve applying vendor-provided kernel patches that address this specific race condition in the net/sched module. The fix described involves deferring the freeing of qdiscs using RCU (Read-Copy-Update) mechanisms to ensure that all readers have completed their access before memory is reclaimed, thereby eliminating the window for use-after-free exploitation. Administrators should prioritize updating kernel packages on production systems to incorporate these fixes. Furthermore, implementing strict input validation and least privilege principles for netlink socket usage can reduce the attack surface by limiting which users or processes are permitted to modify traffic control rules. Regular security audits focusing on network subsystem configurations and keeping software dependencies up to date remain essential practices for maintaining resilience against such kernel-level vulnerabilities.