High 7.8Published Sep 25, 2026

CVE-2026-98017net/sched: defer qdisc freeing after failed creation

Updated under an hour ago (Oct 27, 2026, 5:23 PM ET)

This data is behind schedule: last updated Oct 27, 2026, 5:20 PM ET. We are working on it.Behind: CVE records (cvelistV5).

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it. Retire failed qdiscs through the same RCU helper as normal destruction. Inline the synchronous free into the callback now that no direct callers remain.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 96a27a3e64e7c87abade03fb2ad04ed66992a89a; 51ab2994c387c80b45caf8b8067b3f3b97771d25 builds before 6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d; 51ab2994c387c80b45caf8b8067b3f3b97771d25 builds before 20bf6fa34b345333971bd4464a322cce87b83f4e; from 51ab2994c387c80b45caf8b8067b3f3b97771d25 before 156a3bab69744e9225bb9eff8c5cc53da18d5a2e; 51ab2994c387c80b45caf8b8067b3f3b97771d25 builds before 5bfe927c5b4b290fad529186218c728589b4b101; from 51ab2994c387c80b45caf8b8067b3f3b97771d25 before e6662f2100f8d33b0f4d0047c219efd6bba186ea	CNA record

References

References

https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a
https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d
https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e
https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e
https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101
https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.