CVE-2026-98380: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98380 Overview

CVE-2026-98380 is a Linux kernel vulnerability in the net/sched traffic control action subsystem. The flaw resides in tcf_action_delete() and tcf_idr_delete_index() in net/sched/act_api.c. The delete path drops the lookup reference before invoking tcf_idr_delete_index(), allowing an unlocked classifier to remove the action and reserve the same IDR slot with ERR_PTR(-EBUSY) between operations. The subsequent dereference of tcfa_bindcnt on the error pointer triggers a null-pointer-deref style fault reported by KASAN. The fix treats IDR error pointers as absent and returns -ENOENT.

Critical Impact
A local attacker racing classifier operations against action deletion can trigger a kernel general protection fault, resulting in a denial of service through kernel panic.

Affected Products

Linux kernel (upstream net/sched subsystem)
Stable kernel branches receiving the backported fixes referenced in the git commits
Distributions shipping affected kernel versions prior to the patch commits

Discovery Timeline

2026-10-09 - CVE CVE-2026-98380 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98380

Vulnerability Analysis

The vulnerability is a race condition in the Linux kernel traffic control (tc) action subsystem that leads to a kernel-mode null pointer dereference. The function tcf_action_delete() performs a lookup to obtain a reference on a tc_action, then drops that reference before passing the saved action index to tcf_idr_delete_index().

Because the lookup reference is released early, another CPU running an unlocked classifier operation can remove the action and reserve the same IDR slot with the sentinel value ERR_PTR(-EBUSY). When tcf_idr_delete_index() subsequently fetches the pointer from the IDR, it only validates against NULL and treats the error pointer as a valid tc_action.

The KASAN report confirms the crash path: tca_action_gd -> tcf_action_delete -> tcf_idr_delete_index dereferences tcfa_bindcnt on ERR_PTR(-EBUSY), producing the non-canonical address 0xdffffc0000000002 and a general protection fault.

Root Cause

The root cause is incomplete pointer validation combined with a time-of-check to time-of-use (TOCTOU) window. tcf_idr_delete_index() checks the IDR lookup result only for NULL, not for IS_ERR(). The IDR layer legitimately stores ERR_PTR(-EBUSY) as a reservation marker, so any code path that queries the IDR must handle both cases.

Attack Vector

Exploitation requires local access with the ability to invoke tc action operations, typically via netlink in a namespace where traffic control configuration is permitted. The attacker races two operations: deletion of a tc action through tca_action_gd and classifier-driven removal that triggers the reservation of the same IDR slot. The original researcher used a hardware execution breakpoint to deterministically schedule the interleaving without modifying the kernel source. Successful exploitation produces a kernel panic denying service to the host.

The vulnerability mechanism is described in the upstream commit messages referenced below. No public proof-of-concept has been published in the enriched data.

Detection Methods for CVE-2026-98380

Indicators of Compromise

Kernel oops or general protection fault with RIP pointing into tcf_idr_delete_index+0x... or tca_action_gd+0x....
KASAN report of null-ptr-deref reading 4 bytes at a low address such as 0x0000000000000010 from tca_action_gd.
Unexpected kernel panic messages referencing net/sched/act_api.c lines around tcf_idr_delete_index and tcf_action_delete.

Detection Strategies

Ingest kernel ring-buffer logs and alert on BUG: KASAN entries that reference net/sched symbols.
Monitor crash dumps and kdump artifacts for repeated faults in the tc action delete path, which indicates probing or exploitation attempts.
Audit netlink traffic from unprivileged user namespaces for high-rate RTM_DELACTION operations correlated with classifier changes.

Monitoring Recommendations

Centralize dmesg, /var/log/kern.log, and crash reports from Linux hosts into a SIEM or data lake for correlation.
Track process execution of tc and other iproute2 utilities, especially from non-administrative accounts or containers.
Baseline kernel panic frequency per host and alert on deviations following rollout of new workloads.

How to Mitigate CVE-2026-98380

Immediate Actions Required

Apply the upstream fix from the referenced git commits to all affected kernel builds and reboot into the patched kernel.
Restrict CAP_NET_ADMIN within user namespaces where traffic control manipulation is not required for workload function.
Disable creation of unprivileged user namespaces on hosts that do not need them by setting kernel.unprivileged_userns_clone=0 where supported.

Patch Information

The fix adds a guard that treats IDR error pointers as absent and returns -ENOENT from tcf_idr_delete_index(). Patched commits are available upstream:

Workarounds

Where patching is delayed, prevent untrusted local users and containers from issuing tc action commands by removing CAP_NET_ADMIN from their effective capability set.
Use seccomp or AppArmor profiles to block netlink sockets of family NETLINK_ROUTE for workloads that do not require them.
Disable unprivileged user namespaces on multi-tenant hosts to prevent containers from obtaining CAP_NET_ADMIN in a private namespace.

bash

# Reduce exposure until the patched kernel is deployed
sysctl -w kernel.unprivileged_userns_clone=0

# Verify running kernel version against patched builds
uname -r

# Confirm whether the patched commit is present in the running source tree
grep -n "IS_ERR" net/sched/act_api.c | head