{"id":"CVE-2026-98017","summary":"net/sched: defer qdisc freeing after failed creation","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during -\u003einit(), publishing an embedded mini_Qdisc to lockless\nreaders.  If the same request has an invalid TCA_RATE, estimator setup\nfails after -\u003einit(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain.","modified":"2026-09-26T03:48:31.563013766Z","published":"2026-09-25T10:23:39.107Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98017.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98017.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98017"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"51ab2994c387c80b45caf8b8067b3f3b97771d25"},{"fixed":"20bf6fa34b345333971bd4464a322cce87b83f4e"},{"fixed":"156a3bab69744e9225bb9eff8c5cc53da18d5a2e"},{"fixed":"5bfe927c5b4b290fad529186218c728589b4b101"},{"fixed":"e6662f2100f8d33b0f4d0047c219efd6bba186ea"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98017.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98017.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}