CVE-2026-98235 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: release tail references on DELACTION failure
A batched RTM_DELACTION request takes a temporary reference on each action before attempting any deletion. tcf_action_delete() clears each processed slot and drops its temporary reference before attempting the deletion. If deletion fails, tca_action_gd() calls tcf_action_put_many() to release the remaining references, but its tcf_act_for_each_action() iterator stops at the first NULL slot.
When a batch stops at an action bound to a filter, this leaks a reference on each subsequent action. A later delete of an unbound action can then return success without removing it from the IDR.
Walk the full array in tcf_action_put_many() and skip NULL slots to release the references held on the unprocessed actions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel networking subsystem contains a reference counting flaw within the traffic control action API, specifically affecting batched deletion operations for network filters. This vulnerability arises from an inconsistency in how temporary object references are managed when a bulk delete request encounters failures or incomplete processing sequences. The core issue lies in the interaction between the tcf_action_delete function and its helper routine tcf_action_put_many during the handling of RTM_DELACTION requests, which can lead to resource leaks and potential state corruption within the kernel's internal data structures.
When a batched deletion request is processed, the system initially takes temporary references on each action slated for removal to ensure they remain valid throughout the operation. The tcf_action_delete function iterates through these actions, clearing slots that have been successfully processed and dropping their associated temporary references before attempting the actual deletion from the kernel's internal identifier space. However, if a specific deletion fails or is interrupted because an action is bound to another filter, the error handling path in tca_action_gd invokes tcf_action_put_many to release any remaining unprocessed references. The critical flaw exists within this cleanup routine: its iterator function, tcf_act_for_each_action, terminates prematurely upon encountering the first NULL slot rather than continuing to traverse the entire array of actions involved in the batch request.
This premature termination means that for any subsequent actions in the batch that were not yet processed due to an earlier failure or boundary condition, their temporary references are never released. Consequently, these objects retain a reference count higher than intended, preventing them from being fully garbage collected when they should be. This results in a memory leak where kernel resources accumulate over time as more such failed deletion batches occur. More critically, because the internal state is not properly synchronized with the actual object lifecycle, subsequent operations on unbound actions may incorrectly report success without actually removing the action from the identifier registry or cleaning up associated data structures.
The operational impact of this vulnerability includes gradual memory exhaustion in systems that frequently manipulate complex traffic control rulesets, potentially leading to denial of service conditions through resource starvation. Furthermore, the inconsistency between reported status and actual state can cause unpredictable behavior in network filtering logic, as actions may persist in the system despite being logically deleted or modified by administrative commands. This undermines the reliability of network policy enforcement mechanisms that depend on precise configuration states.
To mitigate this vulnerability, it is essential to apply kernel patches that modify tcf_action_put_many to iterate through the full array of action pointers rather than stopping at the first null entry. By skipping NULL slots and ensuring all remaining references are properly released regardless of where a batch operation halts, the reference counting integrity is restored. System administrators should ensure their Linux kernels are updated with the latest security fixes addressing this specific logic error in net/sched/act_api.c to prevent resource leaks and maintain accurate state management for network traffic control configurations. This issue aligns with CWE-401, which describes a missing release of memory after successful allocation, and relates to ATT&CK techniques involving resource manipulation that can degrade system availability or stability over time through improper object lifecycle management.