SB20261022427 - Race condition in Linux kernel sched

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022427

SB20261022427 - Race condition in Linux kernel sched

Published: October 22, 2026

Security Bulletin ID SB20261022427
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2026-98811)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to retain kernel resources unnecessarily, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to a race condition in the Linux kernel traffic-control classifier error handling in net/sched/cls_api.c when concurrent filter-add requests on the same chain and priority both fail. A local user can trigger these concurrent failures to leave an empty classifier proto linked to the chain, retaining chain, block, and classifier module references and potentially exhausting resources.

Exploitation requires CAP_NET_ADMIN, but namespace-local capability obtained through unshare -Urn is sufficient.


Remediation

Install update from vendor's website.

References