Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98235
Published: October 7, 2026
Vulnerability identifier: #VU153780
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98235
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to leak traffic control action references and leave actions registered after successful deletion requests.
The vulnerability exists due to incomplete resource release in tcf_action_put_many() in net/sched/act_api.c when processing a failed batched RTM_DELACTION request. A local user can submit a batch whose deletion fails at an action bound to a filter to leak traffic control action references and leave actions registered after successful deletion requests.
The leaked references belong to subsequent, unprocessed actions in the batch. A later deletion of an unbound action can report success without removing that action from the IDR.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98235
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1