rootpwn

high · CVSS v3 7.8

CVE-2026-98017

CVE-2026-98017 is a use-after-free in the Linux kernel traffic-control (net/sched) qdisc creation failure path. A failed RTM_NEWQDISC reques

Overview

CVE-2026-98017 is a use-after-free in the Linux kernel traffic-control (net/sched) qdisc creation failure path. A failed RTM_NEWQDISC request can free a qdisc while lockless readers may still reference it, risking memory corruption. It matters because local actors with permission to configure traffic control may be able to trigger kernel instability or privilege escalation.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

Impact

Confidentiality and integrity may be affected if an attacker can trigger the use-after-free and gain code execution in kernel context. Availability is impacted through kernel crashes or traffic-control misbehavior. Local users or workloads with CAP_NET_ADMIN or equivalent netlink access are the primary affected population. Systems with untrusted local users, containers, or multi-tenant hosts are at higher risk.

Remediation

Apply the vendor or distribution kernel update that defers failed qdisc freeing through the RCU destruction path. Reboot or reload the kernel as required and verify the patched version. Restrict CAP_NET_ADMIN and netlink access to trusted administrators only. Audit local users, container privileges, and network namespaces for unnecessary traffic-control permissions. Monitor kernel logs for crashes or qdisc-related faults until patched.

Risk context

The CVSS v3 score is 7.8 (High), indicating a serious local privilege escalation or denial-of-service risk. No EPSS data is provided, so exploit likelihood is not quantified. Treat as high priority for systems where untrusted local users or workloads can issue traffic-control netlink requests.

Affected products

  • Linux kernel
  • Linux net/sched
  • Linux clsact
  • Linux qdisc

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.8
CVSS v4
—
EPSS
—

linux-kernel use-after-free net-sched qdisc local-privilege-escalation denial-of-service netlink

← All CVEs

Related CVEs

high

CVE-2026-98026

This vulnerability affects the Linux kernel's bridge multicast handling. An improper RCU usage can lead to premature freeing of port group structures, potentially causing memory corruption or crashes. The fix converts mglist to RCU and corrects initialization order.

View analysis

high

CVE-2026-98101

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

View analysis

high

CVE-2026-97990

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as a large positive length in the RX path. The bug can lead to memory corruption or denial of service when the kernel processes received packets. It was fixed by adding checks for non‑positive pull results before using the length.

View analysis

high

CVE-2026-97991

CVE-2026-97991 is a Linux kernel vulnerability affecting the vDPA block device driver. It allows out-of-range buffer offsets to be used in read/write operations, leading to potential memory corruption. The flaw can be triggered by VIRTIO_BLK_T_IN, VIRTIO_BLK_T_OUT, or VIRTIO_BLK_T_WRITE_ZEROES requests.

View analysis