Answer in brief
CVE-2026-98811 records a Unknown severity vulnerability in net/sched: cls_api: reclaim an empty proto on the error path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8b64678e0af8f4d62a40149baedebe78503a5255 <315e4fe65cf02ef052de5e6298c3088e448b7517 || >=8b64678e0af8f4d62a40149baedebe78503a5255 <ebc9611ab154c0cd9f1320e2a73f5e936d7535a9 || >=8b64678e0af8f4d62a40149baedebe78503a5255 <570141625d212fbbcffb9665cb45c0f04610e61a || >=8b64678e0af8f4d62a40149baedebe78503a5255 <0bb8eab29b55045281a4963d4557f2776cdf8cfa | 315e4fe65cf02ef052de5e6298c3088e448b7517, ebc9611ab154c0cd9f1320e2a73f5e936d7535a9, 570141625d212fbbcffb9665cb45c0f04610e61a, 0bb8eab29b55045281a4963d4557f2776cdf8cfa |
| Linux/Linuxgeneric | 5.1 | Not reported |
| Linux/Linuxgeneric | >=8b64678e0af8f4d62a40149baedebe78503a5255 <0fc74e7d97d232095ce64cb45d25f0919df7ad4a || >=8b64678e0af8f4d62a40149baedebe78503a5255 <315e4fe65cf02ef052de5e6298c3088e448b7517 || >=8b64678e0af8f4d62a40149baedebe78503a5255 <ebc9611ab154c0cd9f1320e2a73f5e936d7535a9 || >=8b64678e0af8f4d62a40149baedebe78503a5255 <570141625d212fbbcffb9665cb45c0f04610e61a || >=8b64678e0af8f4d62a40149baedebe78503a5255 <0bb8eab29b55045281a4963d4557f2776cdf8cfa | 0fc74e7d97d232095ce64cb45d25f0919df7ad4a, 315e4fe65cf02ef052de5e6298c3088e448b7517, ebc9611ab154c0cd9f1320e2a73f5e936d7535a9, 570141625d212fbbcffb9665cb45c0f04610e61a, 0bb8eab29b55045281a4963d4557f2776cdf8cfa |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change() on the shared proto and both can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up because the loser's handle is still in the idr, and the loser's error path drops only its own reference without a second reclamation attempt. The empty proto stays linked in the chain, holding the chain reference, a block reference and the classifier module reference until the chain or block is torn down. Reclaim the proto on the error path of any failed request that holds a proto reference. The reclamation is emptiness-gated: tcf_chain_tp_delete_empty() unlinks the proto only when delete_empty() admits it is empty, so a live shared proto is never unlinked. A proto the request created is reclaimed unconditionally - it is the only owner, so marking it for deletion is safe even without a delete_empty callback. Classifiers without one (the check marks the proto unconditionally) are rtnl-serialized, so the raced window this guard closes cannot arise for them. This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix teardown of an adopted proto on insert-race loss"), which stopped the loser of the insert race from unlinking the winner's live proto but left the empty-proto residual in place. Conditions to recreate: - CONFIG_NET_CLS_FLOWER=y; veth pair - tc qdisc add dev veth0 ingress - two concurrent `tc filter add dev veth0 ingress protocol ip pref 1 flower skip_sw ... action drop` (both fail in fl_hw_replace_filter after publishing their handle in the idr); repeat in a loop - an empty flower tp stays linked after both requests fail; visible as a bare `filter protocol ip pref 1 flower chain 0` header in `tc filter show` with no filter entries - CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)
Quoted source text, attributed separately from HOL analysis.