---
id: CVE-2026-98017
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: defer qdisc freeing after failed creation

  An RTM_NEWQDISC request can make clsact bind a populated shared ingress
  block during ->init(), publishing an embed…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: defer qdisc freeing after failed creation

  An RTM_NEWQDISC request can make clsact bind a populated shared ingress
  block during ->init(), publishing an embed…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 <
    20bf6fa34b345333971bd4464a322cce87b83f4e
  - >-
    Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 <
    156a3bab69744e9225bb9eff8c5cc53da18d5a2e
  - >-
    Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 <
    5bfe927c5b4b290fad529186218c728589b4b101
  - >-
    Linux >= 51ab2994c387c80b45caf8b8067b3f3b97771d25 <
    e6662f2100f8d33b0f4d0047c219efd6bba186ea
  - Linux 4.16
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:03.697'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98017'
references:
  - url: 'https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.857Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: defer qdisc freeing after failed creation

An RTM_NEWQDISC request can make clsact bind a populated shared ingress
block during ->init(), publishing an embedded mini_Qdisc to lockless
readers.  If the same request has an invalid TCA_RATE, estimator setup
fails after ->init(); the unwind removes the pointer but synchronously
frees its containing qdisc while tc_run() may still hold it.

Retire failed qdiscs through the same RCU helper as normal destruction.
Inline the synchronous free into the callback now that no direct callers
remain.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.