CVE-2026-98380

A flaw was found in the Linux kernel's traffic control subsystem. A local attacker with network configuration privileges can exploit a race condition during traffic control action deletion to cause a Denial of Service (DoS) by crashing the system. Due to missing error validation during action cleanup, the kernel treats an error indicator as a valid action structure, leading to an invalid memory access and a kernel panic.

This vulnerability is rated as having a Moderate impact because exploitation requires local access with elevated network administration privileges and tight race timing to induce a kernel crash. In standard Red Hat Enterprise Linux deployments, unprivileged users lack the authorization necessary to manipulate kernel traffic scheduling actions. Consequently, potential abuse is restricted to privileged accounts or environments with delegated network capabilities, limiting the overall risk to system availability without exposing user data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.