CVE-2026-98811

Что произошло

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on the shared proto and both can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up because the loser's handle is still in the idr, and the loser's error path drops only its own reference without a second reclamation attempt. The empty proto stays linked in the chain, holding the chain reference, a block reference and the classifier module reference until the chain or block is torn down. Reclaim the proto on the error path of any failed request that holds a proto reference. The reclamation is emptiness-gated: tcf_chain_tp_delete_empty() unlinks the proto only when delete_empty() admits it is empty, so a live shared proto is never unlinked. A proto the request created is reclaimed unconditionally - it is the only owner, so marking it for deletion is safe even without a delete_empty callback. Classifiers without one (the check marks the proto unconditionally) are rtnl-serialized, so the raced window this guard closes cannot arise for them. This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix teardown of an adopted proto on insert-race loss"), which stopped the loser of the insert race from unlinking the winner's live proto but left the empty-proto residual in place. Conditions to recreate: - CONFIG_NET_CLS_FLOWER=y; veth pair - tc qdisc add dev veth0 ingress - two concurrent `tc filter add dev veth0 ingress protocol ip pref 1 flower skip_sw ... action drop` (both fail in fl_hw_replace_filter after publishing their handle in the idr); repeat in a loop - an empty flower tp stays linked after both requests fail; visible as a bare `filter protocol ip pref 1 flower chain 0` header in `tc filter show` with no filter entries - CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "0f005c9b8b2e4c018e598cbaf490f27bebfd3d1f",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "00ad96ee96760d2f12f8c4b3a43f6c6b742c452f",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "0fc74e7d97d232095ce64cb45d25f0919df7ad4a",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "315e4fe65cf02ef052de5e6298c3088e448b7517",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "ebc9611ab154c0cd9f1320e2a73f5e936d7535a9",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "570141625d212fbbcffb9665cb45c0f04610e61a",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
  "lessThan": "0bb8eab29b55045281a4963d4557f2776cdf8cfa",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "5.1"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "5.1",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "5.15.224",
  "versionType": "semver",
  "lessThanOrEqual": "5.15.*"
}

{
  "status": "unaffected",
  "version": "6.1.191",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.160",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.113",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.56",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.10",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-03T21:16:07.953536+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.922186+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.922186+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.922186+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-03T21:16:07.953536+00:00"
  },
  "references": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.922186+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены04.11.2026, 00:16
2. Данные обновлены03.11.2026, 00:15
3. Данные обновлены02.11.2026, 00:13
4. Данные обновлены31.10.2026, 12:00
5. Данные обновлены30.10.2026, 20:51
6. Данные обновлены30.10.2026, 15:58
7. Данные обновлены29.10.2026, 12:47
8. Опубликована28.10.2026, 23:17

Личная заметка и статус

Другие CVE того же продукта