CVE-2026-90099

A flaw was found in the Linux kernel's network scheduler. An unprivileged user can exploit a memory accounting vulnerability in the traffic control (tc) classifier. By creating a large number of filters, an attacker can cause the kernel to pin memory outside of memory cgroup (memcg) limits, leading to kernel memory exhaustion and a denial of service (DoS) condition.

Traffic control classifier allocation paths used GFP_KERNEL instead of GFP_KERNEL_ACCOUNT, so a local user with access to a user and network namespace could create many tc filters and pin kernel memory outside memcg charging. This can bypass cgroup memory limits and grow system slab usage until the host suffers memory pressure or denial of service. For the CVSS the PR:L is used because reliable triggering requires local code execution with tc filter creation capability in a network namespace or CAP_NET_ADMIN, not remote packet delivery. The issue is not directly network reachable and is triggered through the tc control plane. In addition to resource exhaustion, cls_basic had an error path where an object inserted into an IDR could be freed without idr_remove after a percpu allocation failure, leaving a dangling pointer and making the issue a UAF candidate under memory pressure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.