Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90248— net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： net/sched: cls_api：修复在 insert 竞争失败时“被采用”协议族的拆链（teardown）问题 在 中，创建分支在调用 之前会设置 。当调用方在竞争失败（即另一个请求先在同一 chain/prio 处插入了一个 proto）时， 会销毁调用方自己的 ，并返回获胜者的 proto（附带一个额外的引用）。由于 从未被清除，失败方的 路径错误地将获胜方的活跃 proto 视为己方所有，并对其调用了 ，从而静默地解链（unlink）了一个由获胜请求已通过

AI Predicted 5.5 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1598 · Phishing for Information

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 8b64678e0af8f4d62a40149baedebe78503a5255< a68e664ddf16ecae6d769d6a2eb356f8abab75c9 affected
8b64678e0af8f4d62a40149baedebe78503a5255< df02b6dc136af45e92ee4c86f4aa6c9a60790b1e affected
8b64678e0af8f4d62a40149baedebe78503a5255< bee2208276c8e0e40a249ffdcf6e5434a79a847c affected
8b64678e0af8f4d62a40149baedebe78503a5255< 219c87aeefdcc8c1caf28cc99e9b361ce7393d3a affected
8b64678e0af8f4d62a40149baedebe78503a5255< bbe2fd6d77df630356185406a97317f6aa6a92cf affected
8b64678e0af8f4d62a40149baedebe78503a5255< dc8b33b819cb02a75936940c120aa669ad89942d affected
8b64678e0af8f4d62a40149baedebe78503a5255< d4e359b3608a0e184bbe8d61a5c3b50d0831c44a affected
5.1 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90248

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix teardown of an adopted proto on insert-race loss In tc_new_tfilter() the create branch sets tp_created = 1 before calling tcf_chain_tp_insert_unique(). When the caller loses the race (another request inserted a proto at the same chain/prio first), insert_unique() destroys the caller's own tp_new and returns the winner's proto with an extra reference. tp_created was never cleared, so the loser's errout path treated the winner's live proto as its own and called tcf_chain_tp_delete_empty() on it, silently unlinking an active classifier that the winning request already advertised via RTM_NEWTFILTER. Track the outcome of the insert step in a single tri-state variable so each errout path reacts correctly: - TP_NOT_CREATED: no proto created; pursue the old path. - TP_CREATED: proto inserted successfully; same code path as before. - TP_NOT_OWNED: New - lost the insert race; tp is another request's proto (chain ref already released by tp_new's destroy) Both errout reactions are single expressions derived from the state. This fix is motivated by the Sashiko's automated review of Patch (net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers) [1][2]. The review identified the silent-unlink behaviour of an adopted proto's teardown when a request loses the tcf_chain_tp_insert_unique() race. [1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com [2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8b64678e0af8f4d62a40149baedebe78503a5255 ~ a68e664ddf16ecae6d769d6a2eb356f8abab75c9 -
Linux Linux 5.1 -

II. Public POCs for CVE-2026-90248

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90248

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90248 (1)

Other References for CVE-2026-90248 (6)

Same Patch Batch · Linux · 2026-09-17 · 602 CVEs total

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string
CVE-2026-90238 media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90239 media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure
CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry
CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
CVE-2026-90244 iommu/dma: Restore locking around msi_page_list
CVE-2026-90245 fbdev: kyro: Validate overlay viewport coordinates
CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check
CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length
CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled
CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
CVE-2026-90256 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime
CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

Showing top 20 of 602 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90248

No comments yet

Leave a comment