CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 0190c1d452a91c38a3462abdd81752be1b9006a8, < 39b751a210bf61a374afa82749afc7a77a08bf1dUpgrade to: 39b751a210bf61a374afa82749afc7a77a08bf1dAffected: ≥ 0190c1d452a91c38a3462abdd81752be1b9006a8, < dd80a7519824b72c8fcfd3cc50cb93f7e2d90923Upgrade to: dd80a7519824b72c8fcfd3cc50cb93f7e2d90923Affected: ≥ 0190c1d452a91c38a3462abdd81752be1b9006a8, < 6bf076258aac4e0af69ef317656c31ce6444d647Upgrade to: 6bf076258aac4e0af69ef317656c31ce6444d647Affected: ≥ 0190c1d452a91c38a3462abdd81752be1b9006a8, < 6c9f07bf8800171de2cd3f02815cebe1f4d45f2dUpgrade to: 6c9f07bf8800171de2cd3f02815cebe1f4d45f2d + 4 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf_action_delete() drops the reference held by its lookup before calling tcf_idr_delete_index() with the saved action index. An unlocked classifier can remove that action and reserve the same IDR slot with ERR_PTR(-EBUSY) in between. tcf_idr_delete_index() only checks the lookup result for NULL. It therefore treats the reservation as a tc_action and dereferences tcfa_bindcnt. A hardware execution breakpoint was used to schedule the interleaving without changing the kernel source. KASAN reported this decoded trace: BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010 Read of size 4 at addr 0000000000000010 by task poc/150 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002 RIP: tca_action_gd+0x5c0/0x1010: arch_atomic_read at arch/x86/include/asm/atomic.h:23 raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457 atomic_read at include/linux/atomic/atomic-instrumented.h:33 tcf_idr_delete_index at net/sched/act_api.c:766 tcf_action_delete at net/sched/act_api.c:1859 tcf_del_notify at net/sched/act_api.c:2014 tca_action_gd at net/sched/act_api.c:2064 R13: 0000000000000010 R15: fffffffffffffff0 Kernel panic - not syncing: Fatal exception R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces the address in R13. With the guard applied, the same reproducer returned -ENOENT without a KASAN report or panic. Treat error pointers as absent and return -ENOENT.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/39b751a210bf61a374afa82749afc7a77a08bf1d
- git.kernel.org/stable/c/dd80a7519824b72c8fcfd3cc50cb93f7e2d90923
- git.kernel.org/stable/c/6bf076258aac4e0af69ef317656c31ce6444d647
And 5 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI