« Volver al listado

CVE-2026-90248

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

In tc_new_tfilter() the create branch sets tp_created = 1 before calling tcf_chain_tp_insert_unique(). When the caller loses the race (another request inserted a proto at the same chain/prio first), insert_unique() destroys the caller's own tp_new and returns the winner's proto with an extra reference. tp_created was never cleared, so the loser's errout path treated the winner's live proto as its own and called tcf_chain_tp_delete_empty() on it, silently unlinking an active classifier that the winning request already advertised via RTM_NEWTFILTER.

Leer descripción completaMostrar menos

Track the outcome of the insert step in a single tri-state variable so each errout path reacts correctly:

- TP_NOT_CREATED: no proto created; pursue the old path. - TP_CREATED: proto inserted successfully; same code path as before. - TP_NOT_OWNED: New - lost the insert race; tp is another request's proto (chain ref already released by tp_new's destroy)

Both errout reactions are single expressions derived from the state.

This fix is motivated by the Sashiko's automated review of Patch (net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers) [1][2]. The review identified the silent-unlink behaviour of an adopted proto's teardown when a request loses the tcf_chain_tp_insert_unique() race.

[1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com [2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90248",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "a68e664ddf16ecae6d769d6a2eb356f8abab75c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "df02b6dc136af45e92ee4c86f4aa6c9a60790b1e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "bee2208276c8e0e40a249ffdcf6e5434a79a847c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "219c87aeefdcc8c1caf28cc99e9b361ce7393d3a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "bbe2fd6d77df630356185406a97317f6aa6a92cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "dc8b33b819cb02a75936940c120aa669ad89942d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b64678e0af8f4d62a40149baedebe78503a5255",
              "lessThan": "d4e359b3608a0e184bbe8d61a5c3b50d0831c44a",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/sched/cls_api.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/sched/cls_api.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:20.947",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/219c87aeefdcc8c1caf28cc99e9b361ce7393d3a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a68e664ddf16ecae6d769d6a2eb356f8abab75c9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bbe2fd6d77df630356185406a97317f6aa6a92cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bee2208276c8e0e40a249ffdcf6e5434a79a847c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d4e359b3608a0e184bbe8d61a5c3b50d0831c44a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dc8b33b819cb02a75936940c120aa669ad89942d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/df02b6dc136af45e92ee4c86f4aa6c9a60790b1e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: fix teardown of an adopted proto on insert-race loss\n\nIn tc_new_tfilter() the create branch sets tp_created = 1 before calling\ntcf_chain_tp_insert_unique(). When the caller loses the race (another\nrequest inserted a proto at the same chain/prio first), insert_unique()\ndestroys the caller's own tp_new and returns the winner's proto with an\nextra reference. tp_created was never cleared, so the loser's errout\npath treated the winner's live proto as its own and called\ntcf_chain_tp_delete_empty() on it, silently unlinking an active\nclassifier that the winning request already advertised via\nRTM_NEWTFILTER.\n\nTrack the outcome of the insert step in a single tri-state variable so\neach errout path reacts correctly:\n\n- TP_NOT_CREATED: no proto created; pursue the old path.\n- TP_CREATED: proto inserted successfully; same code path as before.\n- TP_NOT_OWNED: New - lost the insert race; tp is another request's proto\n  (chain ref already released by tp_new's destroy)\n\nBoth errout reactions are single expressions derived from the state.\n\nThis fix is motivated by the Sashiko's automated review of Patch\n(net/sched: cls_api: Always acquire rtnl_lock when destroying locked\nclassifiers) [1][2]. The review identified the silent-unlink behaviour of\nan adopted proto's teardown when a request loses the\ntcf_chain_tp_insert_unique() race.\n\n[1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com\n[2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com"
    }
  ],
  "lastModified": "2026-09-17T17:17:20.947",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}