Linux Kernel Vulnerability in Network Scheduler by Linux Foundation

CVE-2026-98017

What is CVE-2026-98017?

A vulnerability exists in the Linux kernel's network scheduler where an improper handling of resource management during the initialization process can lead to unexpected behavior. Specifically, an RTM_NEWQDISC request could trigger clsact to bind an already populated shared ingress block. If there is an invalid TCA_RATE, the estimator setup will fail after initialization, and the resulting unwind process compromises resource management, potentially freeing a qdisc while still in use. This issue emphasizes the need for robust handling and destruction of resources in kernel-level code to maintain system integrity.

References