VulnerabilityPublished 18 Oct 2026Updated 21 Oct 2026

CVE-2026-98811: Linux kernel · net/sched: cls_api: reclaim an empty proto on the error path

Source GCVE Database

Authoritative record:CVE-2026-98811

Not known to be exploited · fixed in ebc9611ab154c0cd9f1320e2a73f5e936d7535a9 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ebc9611ab154c0cd9f1320e2a73f5e936d7535a9, 570141625d212fbbcffb9665cb45c0f04610e61a, 315e4fe65cf02ef052de5e6298c3088e448b7517 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-8rvg-cc82-cvp9

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8b64678e0af8f4d62a40149baedebe78503a5255, < ebc9611ab154c0cd9f1320e2a73f5e936d7535a9	Fixed in ebc9611ab154c0cd9f1320e2a73f5e936d7535a9
LinuxLinux	Affected ≥ 8b64678e0af8f4d62a40149baedebe78503a5255, < 570141625d212fbbcffb9665cb45c0f04610e61a	Fixed in 570141625d212fbbcffb9665cb45c0f04610e61a
LinuxLinux	Affected ≥ 8b64678e0af8f4d62a40149baedebe78503a5255, < 315e4fe65cf02ef052de5e6298c3088e448b7517	Fixed in 315e4fe65cf02ef052de5e6298c3088e448b7517
LinuxLinux	Affected ≥ 8b64678e0af8f4d62a40149baedebe78503a5255, < 0fc74e7d97d232095ce64cb45d25f0919df7ad4a	Fixed in 0fc74e7d97d232095ce64cb45d25f0919df7ad4a
LinuxLinux	Affected ≥ 8b64678e0af8f4d62a40149baedebe78503a5255, < 0bb8eab29b55045281a4963d4557f2776cdf8cfa	Fixed in 0bb8eab29b55045281a4963d4557f2776cdf8cfa
LinuxLinux	Affected =5.1	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to reclaim the empty proto on the error path of failed tc filter add requests. Users should update to the kernel version that includes this fix.

Description

A vulnerability in the Linux kernel's network scheduler (net/sched) related to the cls_api component has been resolved. The issue involves a race condition when two concurrent traffic control (tc) filter add requests operate on the same chain and priority of an unlocked classifier. Both requests can fail and leave an empty protocol (proto) linked in the chain, which holds references that should have been released. This residual empty proto can persist until the chain or block is torn down, potentially causing resource retention. The fix ensures that the proto is reclaimed on the error path of any failed request holding a proto reference, preventing the empty proto from lingering.

Impact

The vulnerability causes resource retention in the Linux kernel's network scheduler by leaving an empty proto linked in the chain after concurrent tc filter add requests fail. This can lead to references to the chain, block, and classifier module being held longer than intended, potentially impacting system resource management. There is no indication of direct security compromise such as privilege escalation or denial of service from the provided data.

References

Community reviews

Loading reviews…