{"id":"CVE-2026-98017","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embed…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embed…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 < 20bf6fa34b345333971bd4464a322cce87b83f4e","Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 < 156a3bab69744e9225bb9eff8c5cc53da18d5a2e","Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 < 5bfe927c5b4b290fad529186218c728589b4b101","Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 < e6662f2100f8d33b0f4d0047c219efd6bba186ea","Linux 4.16"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T15:18:03.697","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98017","references":[{"url":"https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.857Z","slug":"CVE-2026-98017","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210930,"id":"CVE-2026-98017","ts":1790349116592,"field":"cvss","old":null,"new":"7.8"},{"seq":210929,"id":"CVE-2026-98017","ts":1790349116592,"field":"severity","old":"none","new":"high"}]}