---
id: CVE-2026-98235
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: act_api: release tail references on DELACTION failure

  A batched RTM_DELACTION request takes a temporary reference on each
  action before attempting any delet…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: act_api: release tail references on DELACTION failure

  A batched RTM_DELACTION request takes a temporary reference on each
  action before attempting any delet…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a0e947c9ccffe47d45aca793d9e7fe4f4494e381 <
    9eaba16f1b6ee19b249e6afd82c27f958d441458
  - >-
    Linux >= a0e947c9ccffe47d45aca793d9e7fe4f4494e381 <
    1be63e4579af408d596f0f3165faf1a880631d3b
  - >-
    Linux >= a0e947c9ccffe47d45aca793d9e7fe4f4494e381 <
    57b477e46ef2df3483f3488cc713c61c4b384aab
  - >-
    Linux >= a0e947c9ccffe47d45aca793d9e7fe4f4494e381 <
    6e05e46fa821a5c1b281355f1f622ac76cb6080a
  - Linux 6.8
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T09:18:11.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98235'
references:
  - url: 'https://git.kernel.org/stable/c/1be63e4579af408d596f0f3165faf1a880631d3b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/57b477e46ef2df3483f3488cc713c61c4b384aab'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e05e46fa821a5c1b281355f1f622ac76cb6080a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9eaba16f1b6ee19b249e6afd82c27f958d441458'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-06T08:50:17.436Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: release tail references on DELACTION failure

A batched RTM_DELACTION request takes a temporary reference on each
action before attempting any deletion. tcf_action_delete() clears
each processed slot and drops its temporary reference before attempting
the deletion. If deletion fails, tca_action_gd() calls
tcf_action_put_many() to release the remaining references, but its
tcf_act_for_each_action() iterator stops at the first NULL slot.

When a batch stops at an action bound to a filter, this leaks a
reference on each subsequent action. A later delete of an unbound
action can then return success without removing it from the IDR.

Walk the full array in tcf_action_put_many() and skip NULL slots to
release the references held on the unprocessed actions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.