CVE-2026-98811: net/sched: cls_api: reclaim an empty proto on the error path

CVE-2026-98811: net/sched: cls_api: reclaim an empty proto on the error path

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: reclaim an empty proto on the error path

Two racing tc filter add requests on the same chain/prio of an
unlocked classifier both run change() on the shared proto and both
can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up
because the loser's handle is still in the idr, and the loser's
error path drops only its own reference without a second reclamation
attempt. The empty proto stays linked in the chain, holding the
chain reference, a block reference and the classifier module
reference until the chain or block is torn down.

Reclaim the proto on the error path of any failed request that holds
a proto reference. The reclamation is emptiness-gated:
tcf_chain_tp_delete_empty() unlinks the proto only when
delete_empty() admits it is empty, so a live shared proto is never
unlinked. A proto the request created is reclaimed unconditionally -
it is the only owner, so marking it for deletion is safe even without
a delete_empty callback. Classifiers without one (the check marks the
proto unconditionally) are rtnl-serialized, so the raced window this
guard closes cannot arise for them.

This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix
teardown of an adopted proto on insert-race loss"), which stopped the
loser of the insert race from unlinking the winner's live proto but
left the empty-proto residual in place.

Conditions to recreate:
- CONFIG_NET_CLS_FLOWER=y; veth pair
- tc qdisc add dev veth0 ingress
- two concurrent `tc filter add dev veth0 ingress protocol ip pref 1
  flower skip_sw ... action drop` (both fail in fl_hw_replace_filter
  after publishing their handle in the idr); repeat in a loop
- an empty flower tp stays linked after both requests fail; visible
  as a bare `filter protocol ip pref 1 flower chain 0` header in
  `tc filter show` with no filter entries
- CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)

The Linux kernel CVE team has assigned CVE-2026-98811 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.1 with commit 8b64678e0af8f4d62a40149baedebe78503a5255 and fixed in 6.12.113 with commit 315e4fe65cf02ef052de5e6298c3088e448b7517
	Issue introduced in 5.1 with commit 8b64678e0af8f4d62a40149baedebe78503a5255 and fixed in 6.18.56 with commit ebc9611ab154c0cd9f1320e2a73f5e936d7535a9
	Issue introduced in 5.1 with commit 8b64678e0af8f4d62a40149baedebe78503a5255 and fixed in 7.2.10 with commit 570141625d212fbbcffb9665cb45c0f04610e61a
	Issue introduced in 5.1 with commit 8b64678e0af8f4d62a40149baedebe78503a5255 and fixed in 7.3-rc6 with commit 0bb8eab29b55045281a4963d4557f2776cdf8cfa

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98811
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sched/cls_api.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/315e4fe65cf02ef052de5e6298c3088e448b7517
	https://git.kernel.org/stable/c/ebc9611ab154c0cd9f1320e2a73f5e936d7535a9
	https://git.kernel.org/stable/c/570141625d212fbbcffb9665cb45c0f04610e61a
	https://git.kernel.org/stable/c/0bb8eab29b55045281a4963d4557f2776cdf8cfa