CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
A race condition in the Linux kernel traffic control subsystem allows local attackers to cause denial of service by triggering incorrect teardown of active classifiers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90248?
CVE-2026-90248 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
In tc_new_tfilter() the create branch sets tp_created = 1 before calling tcf_chain_tp_insert_unique(). When the caller loses the race (another request inserted a proto at the same chain/prio first), insert_unique() destroys the caller's own tp_new and returns the winner's proto with an extra reference. tp_created was never cleared, so the loser's errout path treated the winner's live proto as its own and called tcf_chain_tp_delete_empty() on it, silently unlinking an active classifier that the winning request already advertised via RTM_NEWTFILTER.
Track the outcome of the insert step in a single tri-state variable so each errout path reacts correctly:
- TP_NOT_CREATED: no proto created; pursue the old path. - TP_CREATED: proto inserted successfully; same code path as before. - TP_NOT_OWNED: New - lost the insert race; tp is another request's proto (chain ref already released by tp_new's destroy)
Both errout reactions are single expressions derived from the state.
This fix is motivated by the Sashiko's automated review of Patch (net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers) [1][2]. The review identified the silent-unlink behaviour of an adopted proto's teardown when a request loses the tcf_chain_tp_insert_unique() race.
[1] https://sashiko.dev/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com [2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260801125632.360365-1-jhs%40mojatatu.com
Which versions are affected by CVE-2026-90248?
How do I fix CVE-2026-90248?
Apply the vendor's patch.
Is CVE-2026-90248 being exploited?
There is no known exploitation of CVE-2026-90248 in the wild and no public exploit code.
Sources
Also known as AZL-102564, BELL-CVE-2026-90248, DEBIAN-CVE-2026-90248, GHSA-rm9p-rr32-f7j6, UBUNTU-CVE-2026-90248.