CVE-2026-98380

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: reject IDR error pointers when deleting actions

tcf_action_delete() drops the reference held by its lookup before calling

tcf_idr_delete_index() with the saved action index. An unlocked

classifier can remove that action and reserve the same IDR slot with

ERR_PTR(-EBUSY) in between.

tcf_idr_delete_index() only checks the lookup result for NULL. It

therefore treats the reservation as a tc_action and dereferences

tcfa_bindcnt. A hardware execution breakpoint was used to schedule the

interleaving without changing the kernel source. KASAN reported this

decoded trace:

BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010

Read of size 4 at addr 0000000000000010 by task poc/150

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002

RIP: tca_action_gd+0x5c0/0x1010:

arch_atomic_read at arch/x86/include/asm/atomic.h:23

raw_atomic_read at include/linux/atomic/ato

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References