CVE-2026-90248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

In tc_new_tfilter() the create branch sets tp_created = 1 before calling

tcf_chain_tp_insert_unique(). When the caller loses the race (another

request inserted a proto at the same chain/prio first), insert_unique()

destroys the caller's own tp_new and returns the winner's proto with an

extra reference. tp_created was never cleared, so the loser's errout

path treated the winner's live proto as its own and called

tcf_chain_tp_delete_empty() on it, silently unlinking an active

classifier that the winning request already advertised via

RTM_NEWTFILTER.

Track the outcome of the insert step in a single tri-state variable so

each errout path reacts correctly:

- TP_NOT_CREATED: no proto created; pursue the old path.

- TP_CREATED: proto inserted successfully; same code path as before.

- TP_NOT_OWNED: New - lost the insert race; tp is another request's p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References