CVE-2026-98017 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and prioritize verification of affected systems, focusing on potential use-after-free conditions in Linux kernel's net/sched. Affected operators, platforms, vulnerability-management, and security teams should review Linux kernel configurations and versions to determine exposure, verify qdisc creation and estimator setup in use, and consider applying patches or updates from Linux

Why it matters

A vulnerability in the Linux kernel's net/sched has been resolved, where a failed qdisc creation can lead to a use-after-free condition. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

• Potential use-after-free condition in Linux kernel's net/sched
• Need to verify qdisc creation and estimator setup in use
• Possible denial of service or privilege escalation

Technical summary

The Linux kernel's net/sched has a vulnerability where a failed qdisc creation can lead to a use-after-free condition. This occurs when an RTM_NEWQDISC request binds a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchronously frees its containing qdisc while tc_run() may still hold it.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

Recommended defensive actions

• Review Linux kernel configurations and versions to determine exposure
• Verify qdisc creation and estimator setup in use
• Consider applying patches or updates from Linux kernel maintainers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the affected versions and exploitation status require verification from the supplied official sources. Linux kernel maintainers and users should verify qdisc creation and estimator setup in use, focusing on potential use-after-free conditions. Defensive verification tasks include reviewing Linux kernel configurations and versions to determine exposure, considering applying patches or updates from Linux kernel maintainers, and tracking exceptions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.