CVE-2026-98811

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: reclaim an empty proto on the error path

Two racing tc filter add requests on the same chain/prio of an

unlocked classifier both run change() on the shared proto and both

can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up

because the loser's handle is still in the idr, and the loser's

error path drops only its own reference without a second reclamation

attempt. The empty proto stays linked in the chain, holding the

chain reference, a block reference and the classifier module

reference until the chain or block is torn down.

Reclaim the proto on the error path of any failed request that holds

a proto reference. The reclamation is emptiness-gated:

tcf_chain_tp_delete_empty() unlinks the proto only when

delete_empty() admits it is empty, so a live shared proto is never

unlinked. A proto the request created is reclaimed unconditionally -

it is the only owner, so marking it for deletio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References