CVE-2026-98017

A flaw was found in the Linux kernel's network traffic control subsystem. This flaw allows a local user with network administration privileges to cause a denial of service (DoS) or potentially escalate privileges. A use-after-free condition occurs when the kernel prematurely deallocates network queueing structures after a failed configuration request while concurrent packet processing routines are still referencing them.

A MODERATE severity use-after-free flaw was found in the Linux kernel's network traffic control (net/sched) subsystem, affecting the Red Hat Enterprise Linux kernel and kernel-rt packages. When an RTM_NEWQDISC netlink request binds a populated shared ingress block via clsact and then fails estimator setup because of an invalid TCA_RATE parameter, the error-unwind path synchronously frees the containing queueing discipline (qdisc) while lockless readers in tc_run() may still hold references to it. A local user with the privileges required to configure network traffic control (CAP_NET_ADMIN) could win this race to crash the kernel, resulting in a denial of service. Red Hat rates this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with network administration privileges and the established impact is loss of availability; this differs from the upstream CVEORG score of 7.8, which assumes high confidentiality and integrity impacts that Red Hat's assessment does not establish for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.