VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-90099: Linux kernel · net/sched: account classifier filter allocations to memcg

Source GCVE Database

Compare

Authoritative record:CVE-2026-90099· High

Not known to be exploited · fixed in bf6006cea193cf065f7a64fc7974247f8112af33 : patch Linux kernel soon.

Data as of 30 Oct 2026, 19:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in bf6006cea193cf065f7a64fc7974247f8112af33, 68fb30607169c92de57c5c82b6af8a733af1cc09, 18c68c8f3d3ff0a4def1391021b439c4333a6c71 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-3537-p4vp-g252

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 0da974f4f303a6842516b764507e3c0a03f41e5a, < bf6006cea193cf065f7a64fc7974247f8112af33	Fixed in bf6006cea193cf065f7a64fc7974247f8112af33
LinuxLinux	Affected ≥ 0da974f4f303a6842516b764507e3c0a03f41e5a, < 68fb30607169c92de57c5c82b6af8a733af1cc09	Fixed in 68fb30607169c92de57c5c82b6af8a733af1cc09
LinuxLinux	Affected ≥ 0da974f4f303a6842516b764507e3c0a03f41e5a, < 18c68c8f3d3ff0a4def1391021b439c4333a6c71	Fixed in 18c68c8f3d3ff0a4def1391021b439c4333a6c71
LinuxLinux	Affected ≥ 0da974f4f303a6842516b764507e3c0a03f41e5a, < 8a622d5b4d81c1572f42bbf3fb823b6e63d44dae	Fixed in 8a622d5b4d81c1572f42bbf3fb823b6e63d44dae
LinuxLinux	Affected ≥ 0da974f4f303a6842516b764507e3c0a03f41e5a, < 5fbb06d4f3d4c509ffe95572384a498bf319e5bf	Fixed in 5fbb06d4f3d4c509ffe95572384a498bf319e5bf
LinuxLinux	Affected ≥ 0da974f4f303a6842516b764507e3c0a03f41e5a, < 1beb81947eb486716af80db7a584f9e9fef7e003	Fixed in 1beb81947eb486716af80db7a584f9e9fef7e003

AI-suggested

A fix is available that adds GFP_KERNEL_ACCOUNT to all relevant allocations in the net/sched classifier filter paths and corrects error handling to remove dangling pointers. Users should apply the official Linux kernel patch that addresses this issue. No additional mitigation is indicated beyond applying the patch.

Description

A vulnerability in the Linux kernel's network scheduler (net/sched) allows unprivileged users to allocate kernel memory without proper memory controller group (memcg) accounting. This occurs in the traffic control (tc) classifier filter allocation paths, enabling kernel memory to be pinned outside memcg charging. The issue affects multiple classifiers and was fixed by adding GFP_KERNEL_ACCOUNT to relevant allocations and correcting error handling to prevent dangling pointers in the IDR. Exploitation requires specific kernel configurations and user namespace conditions.

Impact

Unprivileged users can cause kernel memory to be pinned without proper memcg accounting, potentially leading to memory exhaustion or denial of service by bypassing memory limits enforced by cgroups. The issue also includes a dangling pointer in the IDR on allocation failure, which can permanently consume resources. This can affect system stability and resource isolation in multi-tenant or containerized environments.

References

Community reviews

Loading reviews…