In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: reclaim an empty proto on the error path Two racing tc… (CVE-2026-98811)

The vulnerability in the Linux kernel's net/sched cls_api arises from a race condition between two concurrent tc filter add requests on the same chain and priority of an unlocked classifier. Both requests run change() on a shared proto and can fail. The losing request's error path only drops its own reference without attempting a second reclamation, leaving an empty proto linked in the chain. This empty proto holds references to the chain, block, and classifier module, causing resource retention until the chain or block is torn down. The patch introduces a reclamation step on the error path for any failed request holding a proto reference, gated by emptiness checks to ensure live shared protos are not unlinked. This fix follows a previous commit that prevented unlinking of a live proto but did not address the empty proto residual.

The vulnerability causes resource retention in the Linux kernel's network scheduler by leaving an empty proto linked in the chain after concurrent tc filter add requests fail. This can lead to references to the chain, block, and classifier module being held longer than intended, potentially impacting system resource management. There is no indication of direct security compromise such as privilege escalation or denial of service from the provided data.

A fix has been implemented in the Linux kernel to reclaim the empty proto on the error path of failed tc filter add requests. Users should update to the kernel version that includes this fix. Since no patch links or specific fixed versions are provided, check the official Linux kernel advisories or source repositories for the relevant commit and update accordingly.