CVE-2026-90248

A flaw was found in the Linux kernel's network scheduler component (net/sched: cls_api). A race condition exists in the tc_new_tfilter() function during the insertion of a new protocol. If a process loses a race to insert a protocol, its error handling path may incorrectly remove an active network classifier that was successfully established by another process. This could allow a local attacker to cause a denial of service (DoS) by disrupting network traffic classification.

A moderate severity flaw was found in the Linux kernel's network scheduler traffic classifier code (net/sched: cls_api). The flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS images used by OpenShift Container Platform 4. In tc_new_tfilter(), when concurrent requests race to insert a traffic control classifier at the same chain and priority, the request that loses the race follows an error path that incorrectly tears down and unlinks the live classifier that the winning request had already created and advertised via RTM_NEWTFILTER. A local attacker able to configure traffic control filters could exploit this race condition to silently remove an active network classifier, disrupting network traffic classification and causing a denial of service. Only availability is affected; confidentiality and integrity are not impacted (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that release, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support status (OOSS). For the affected products, the fix is deferred: because this is a moderate-severity, local, availability-only race condition, it is slated to be addressed in a future update rather than an immediate erratum. The residual risk is that a local user could disrupt traffic-control classification on an affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.