CVE-2026-98235

A flaw was found in the Linux kernel's network traffic control subsystem. When processing a batched request to delete traffic actions, a failure encountered on an action bound to a filter causes the cleanup process to terminate prematurely without releasing references on subsequent actions. A local user with network administration privileges could exploit this flaw by issuing a crafted deletion request, resulting in a reference count leak that can lead to resource exhaustion and a denial of service (DoS).

A low impact flaw was found in the Linux kernel's network traffic control (net/sched) subsystem. When a batched RTM_DELACTION request fails on an action that is bound to a filter, the error-cleanup path in tcf_action_put_many() stops iterating at the first cleared array slot and fails to release the temporary references held on the remaining actions in the batch. A local user with network administration privileges (CAP_NET_ADMIN) could exploit this flaw by issuing crafted batched action deletion requests, leaking references that keep traffic control actions in the IDR and can lead to resource exhaustion and denial of service. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship RHEL CoreOS 9 (4.19 and later) are affected. Red Hat Enterprise Linux 7 and 8 (kernel and kernel-rt) and the RHEL 9.2 and 9.4 z-streams are not affected because the vulnerable code is not present. The fix is deferred to a future scheduled update because exploitation requires local access with network administration privileges and the demonstrated impact is limited to reference retention and resource exhaustion rather than memory corruption or privilege escalation. The residual risk is a local denial of service by an already-privileged user. For this reason Red Hat rates the overall impact as LOW, lower than the moderate severity implied by the CVSS:3.1 base score of 5.5, which assumes full availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.